Analysis
- max time kernel
898s - max time network
913s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
07/08/2026, 10:44
General
- Target WEAO-LIVE-WindowsPlayer-version-145f189a6a974303/RobloxPlayerBeta.exe
- Size 134.1MB
- Sample260807-mtardack7x
- SHA256 46c0e6bc67f78d2898616702d270ad4625a6bdf3fb0afbafe4e6c4af0a2981bd
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Themida packer 64 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 4 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\WEAO-LIVE-WindowsPlayer-version-145f189a6a974303\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Temp\WEAO-LIVE-WindowsPlayer-version-145f189a6a974303\RobloxPlayerBeta.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WEAO-LIVE-WindowsPlayer-version-145f189a6a974303\RobloxCrashHandler.exeC:\Users\Admin\AppData\Local\Temp\WEAO-LIVE-WindowsPlayer-version-145f189a6a974303\RobloxCrashHandler.exe --no-rate-limit --crashCounter Win-ROBLOXPlayer-Crash --baseUrl http://www.roblox.com/ --buildVariant Win64 --attachment=attachment_0.733.0.7330989_20260807T110146Z_Player_94EFA_last.log=C:\Users\Admin\AppData\Local\Roblox\logs\0.733.0.7330989_20260807T110146Z_Player_94EFA_last.log --database=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --metrics-dir=C:\Users\Admin\AppData\Local\Roblox\logs\crashes --url=https://upload.crashes.rbxinfra.com/post?format=minidump --annotation=AppVersion=0.733.0.7330989 --annotation=BaseUrl=http://www.roblox.com/ --annotation=BuildVariant=Win64 "--annotation=CPUMake=Intel Core Processor (Broadwell)" --annotation=EnableSessionEndCallback=true --annotation=EnableSessionStartCallback=true --annotation=EngineVersion=0.733.0.7330989 --annotation=Format=minidump "--annotation=GPUMake=NVIDIA GeForce RTX 3060 TI" --annotation=OSPlatform=Win32 "--annotation=OSVersion=Windows 10 - PlatformId 2, Version 10.0, Build 19041" --annotation=PID=4120 --annotation=PlatformId=2 --annotation=RobloxChannel=production --annotation=RobloxGitHash=6468eec5ddfa1510f06a43d039a72a6d9307e028 --annotation=RobloxProduct=RobloxPlayer --annotation=TotalMemoryGB=16 --annotation=UniqueId=8137752746836203367 --annotation=UploadAttachmentKiloByteLimit=1000 --annotation=UseCrashpad=True --initial-client-data=0x4a4,0x4a8,0x4ac,0x480,0x4b8,0x7ff617bbf638,0x7ff617bbf650,0x7ff617bbf6682⤵
-
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc1⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
appStorage.json
rbx-storage.id
tombstone.dat
memory/4120-0-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-60-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-61-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-62-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-65-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-66-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-67-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-69-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-70-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-71-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-72-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-73-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-74-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-80-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-81-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-82-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-83-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-84-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-85-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-86-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-87-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-88-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-89-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-90-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-91-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-97-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-98-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-99-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-100-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-101-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-103-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-104-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-105-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-106-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-107-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-108-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-109-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-115-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-116-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-117-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-118-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-119-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-120-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-121-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-122-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-123-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-124-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-125-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-126-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-132-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-133-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-134-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-136-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-137-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-138-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-139-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-140-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-141-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-142-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-143-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-144-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-150-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-151-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-152-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp
memory/4120-153-0x00007FFBD7E40000-0x00007FFBD9B2A000-memory.dmp