Resubmissions
03/08/2026, 18:23
260803-w1n21swajf03/08/2026, 18:22
260803-w1brpavhqb03/08/2026, 18:20
260803-wy6jaax1b1803/08/2026, 18:20
260803-wytjqax1ay603/08/2026, 18:17
260803-ww3dvavfpe6Analysis
- user interaction
yes - max time kernel
148s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 18:17
General
- Target Roblox-2026-07-13T11_41_58.005Z.mp4
- Size 799B
- Sample260803-ww3dvavfpe
- SHA256 6425fa4aca9c8fc2c3c7f45e29d5874c0e481cf4c86ec0a77fd8e286497e1001
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Roblox-2026-07-13T11_41_58.005Z.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-Interactive
memory/4160-100-0x0000000073B80000-0x000000007433C000-memory.dmp
memory/4160-106-0x0000000005E60000-0x00000000061BB000-memory.dmp
memory/4160-98-0x0000000073B92000-0x0000000073B93000-memory.dmp
memory/4160-102-0x0000000073B80000-0x000000007433C000-memory.dmp
memory/4160-103-0x0000000005560000-0x0000000005582000-memory.dmp
memory/4160-99-0x0000000004F40000-0x0000000004F76000-memory.dmp
memory/4160-104-0x0000000005D80000-0x0000000005DE6000-memory.dmp
memory/4160-112-0x0000000073B80000-0x000000007433C000-memory.dmp
memory/4160-110-0x0000000006340000-0x000000000638C000-memory.dmp
memory/4160-109-0x00000000062F0000-0x000000000630E000-memory.dmp
memory/4160-101-0x00000000055D0000-0x0000000005C1A000-memory.dmp
memory/4160-105-0x0000000005DF0000-0x0000000005E56000-memory.dmp
memory/4612-115-0x000002BEFD250000-0x000002BEFD272000-memory.dmp
memory/4612-119-0x000002BEFD770000-0x000002BEFD7B8000-memory.dmp
memory/4708-29-0x00007FF8AD030000-0x00007FF8AD049000-memory.dmp
memory/4708-42-0x00007FF89D620000-0x00007FF89D646000-memory.dmp
memory/4708-12-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-13-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-14-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-15-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-16-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-17-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-18-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-23-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-24-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-28-0x00007FF8AF4F0000-0x00007FF8AF501000-memory.dmp
memory/4708-31-0x00007FF8A1F30000-0x00007FF8A1F5B000-memory.dmp
memory/4708-30-0x00007FF8ACA60000-0x00007FF8ACA82000-memory.dmp
memory/4708-25-0x00007FF685390000-0x00007FF685488000-memory.dmp
memory/4708-26-0x00007FF8A1FA0000-0x00007FF8A1FD4000-memory.dmp
memory/4708-34-0x00007FF8A3240000-0x00007FF8A3251000-memory.dmp
memory/4708-33-0x00007FF8A6F60000-0x00007FF8A6F74000-memory.dmp
memory/4708-35-0x00007FF89A240000-0x00007FF89A312000-memory.dmp
memory/4708-10-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-32-0x00007FF8978F0000-0x00007FF897C80000-memory.dmp
memory/4708-36-0x00007FF897650000-0x00007FF8978E6000-memory.dmp
memory/4708-37-0x00007FF898BB0000-0x00007FF898C98000-memory.dmp
memory/4708-38-0x00007FF897560000-0x00007FF897643000-memory.dmp
memory/4708-40-0x00007FF8A1180000-0x00007FF8A11AF000-memory.dmp
memory/4708-44-0x00007FF89EE80000-0x00007FF89EE9A000-memory.dmp
memory/4708-43-0x00007FF89CD90000-0x00007FF89CDBD000-memory.dmp
memory/4708-11-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-41-0x00007FF8A1F10000-0x00007FF8A1F28000-memory.dmp
memory/4708-46-0x00007FF89D690000-0x00007FF89D6A1000-memory.dmp
memory/4708-47-0x00007FF896F40000-0x00007FF89714B000-memory.dmp
memory/4708-52-0x00007FF89B450000-0x00007FF89B46B000-memory.dmp
memory/4708-53-0x00000262BF8C0000-0x00000262BFAC6000-memory.dmp
memory/4708-54-0x00007FF88F800000-0x00007FF88FA45000-memory.dmp
memory/4708-48-0x00007FF89A1A0000-0x00007FF89A238000-memory.dmp
memory/4708-51-0x00007FF8974B0000-0x00007FF89755B000-memory.dmp
memory/4708-49-0x00007FF898B60000-0x00007FF898BAF000-memory.dmp
memory/4708-50-0x00007FF89A920000-0x00007FF89A945000-memory.dmp
memory/4708-45-0x00007FF89DAC0000-0x00007FF89DAD1000-memory.dmp
memory/4708-9-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-8-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-7-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-6-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-5-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-4-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-3-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-2-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-1-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-0-0x00007FF89884D000-0x00007FF89884F000-memory.dmp
memory/4708-39-0x00007FF89EEA0000-0x00007FF89EEE1000-memory.dmp
memory/4708-55-0x00007FF8985A0000-0x00007FF898856000-memory.dmp
memory/4708-93-0x00007FF8A1FA0000-0x00007FF8A1FD4000-memory.dmp
memory/4708-92-0x00007FF685390000-0x00007FF685488000-memory.dmp
memory/4708-95-0x00007FF8985A0000-0x00007FF898856000-memory.dmp