Analysis
- user interaction
yes - max time kernel
128s - max time network
113s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
16/08/2026, 03:30
General
- Target ExploitStrap-v420.45.exe
- Size 161.6MB
- Sample260816-d2hmhscl71
- SHA256 571b68ebd541d71d589958a47d872e088dd6b75c5a1d54948f348391b378814f
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 11 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
- Modifies registry class 18 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExploitStrap-v420.45.exe"C:\Users\Admin\AppData\Local\Temp\ExploitStrap-v420.45.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ExploitStrap\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\ExploitStrap\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\ExploitStrap\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\ExploitStrap\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\ExploitStrap\ExploitStrap.exe"C:\Users\Admin\AppData\Local\ExploitStrap\ExploitStrap.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ExploitStrap\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\ExploitStrap\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\ExploitStrap\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\ExploitStrap\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
live-builtin.json
PlayerState.json
Settings.json
State.json
RobloxPlayerBeta.dll
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
vcruntime140_cor3.dll
wpfgfx_cor3.dll
memory/3536-110-0x000002095BAD0000-0x000002095BADF000-memory.dmp
memory/3536-116-0x000002095FAD0000-0x000002095FB3F000-memory.dmp
memory/3536-41-0x000002093A9D0000-0x000002093A9D7000-memory.dmp
memory/3536-56-0x000002095B570000-0x000002095B582000-memory.dmp
memory/3536-53-0x000002095B550000-0x000002095B568000-memory.dmp
memory/3536-50-0x000002095B9E0000-0x000002095BA20000-memory.dmp
memory/3536-47-0x000002095B510000-0x000002095B526000-memory.dmp
memory/3536-44-0x000002095B4F0000-0x000002095B509000-memory.dmp
memory/3536-38-0x000002095B440000-0x000002095B453000-memory.dmp
memory/3536-35-0x000002093A9C0000-0x000002093A9C5000-memory.dmp
memory/3536-32-0x00000209390E0000-0x00000209390ED000-memory.dmp
memory/3536-26-0x000002095D330000-0x000002095DB72000-memory.dmp
memory/3536-23-0x000002095B4B0000-0x000002095B4EE000-memory.dmp
memory/3536-62-0x000002095BB30000-0x000002095BC24000-memory.dmp
memory/3536-71-0x000002095BA20000-0x000002095BA4A000-memory.dmp
memory/3536-68-0x000002095BA80000-0x000002095BAC7000-memory.dmp
memory/3536-65-0x000002095B530000-0x000002095B538000-memory.dmp
memory/3536-74-0x000002095FEC0000-0x00000209606DC000-memory.dmp
memory/3536-80-0x000002095B5A0000-0x000002095B5AA000-memory.dmp
memory/3536-77-0x000002095BA50000-0x000002095BA79000-memory.dmp
memory/3536-95-0x000002095BAE0000-0x000002095BAE5000-memory.dmp
memory/3536-92-0x000002095BE30000-0x000002095BE43000-memory.dmp
memory/3536-89-0x000002095C020000-0x000002095C0D5000-memory.dmp
memory/3536-86-0x000002095BB00000-0x000002095BB21000-memory.dmp
memory/3536-83-0x000002095BEC0000-0x000002095BF42000-memory.dmp
memory/3536-101-0x000002095BE80000-0x000002095BE96000-memory.dmp
memory/3536-98-0x000002095BF50000-0x000002095BF8C000-memory.dmp
memory/3536-20-0x000002095B460000-0x000002095B4A5000-memory.dmp
memory/3536-107-0x000002095BFD0000-0x000002095C004000-memory.dmp
memory/3536-104-0x000002095C0E0000-0x000002095C135000-memory.dmp
memory/3536-113-0x000002095C190000-0x000002095C1DA000-memory.dmp
memory/3536-29-0x000002095B5D0000-0x000002095B646000-memory.dmp
memory/3536-119-0x000002095FCC0000-0x000002095FE24000-memory.dmp
memory/3536-125-0x00000209608B0000-0x0000020960A68000-memory.dmp
memory/3536-122-0x000002095FB40000-0x000002095FBC1000-memory.dmp
memory/3536-131-0x000002095C2D0000-0x000002095C2F1000-memory.dmp
memory/3536-128-0x000002095FBD0000-0x000002095FC94000-memory.dmp
memory/3536-137-0x0000020960790000-0x0000020960837000-memory.dmp
memory/3536-141-0x00000209606E0000-0x000002096076A000-memory.dmp
memory/3536-134-0x000002095FE30000-0x000002095FE8C000-memory.dmp
memory/3536-146-0x0000020961280000-0x0000020961341000-memory.dmp
memory/3536-143-0x0000020961E70000-0x0000020962B21000-memory.dmp
memory/3536-154-0x0000020961460000-0x000002096155E000-memory.dmp
memory/3536-151-0x000002095C350000-0x000002095C370000-memory.dmp
memory/3536-165-0x000002095C370000-0x000002095C376000-memory.dmp
memory/3536-162-0x000002095C340000-0x000002095C34D000-memory.dmp
memory/3536-168-0x0000020967160000-0x00000209672CA000-memory.dmp
memory/3536-173-0x0000020966F40000-0x0000020966FBC000-memory.dmp
memory/3536-174-0x0000020965B30000-0x0000020965B49000-memory.dmp
memory/3536-177-0x0000020966FC0000-0x000002096700E000-memory.dmp
memory/3536-183-0x0000020966F10000-0x0000020966F27000-memory.dmp
memory/3536-180-0x0000020966EE0000-0x0000020966F05000-memory.dmp
memory/3536-186-0x0000020967010000-0x0000020967027000-memory.dmp
memory/3536-189-0x0000020967080000-0x00000209670C1000-memory.dmp
memory/3536-192-0x0000020967060000-0x0000020967080000-memory.dmp
memory/3536-195-0x00000209670D0000-0x00000209670D9000-memory.dmp
memory/3536-198-0x00000209674F0000-0x0000020967604000-memory.dmp
memory/3536-201-0x0000020967610000-0x00000209676B2000-memory.dmp
memory/3536-14-0x000002095B650000-0x000002095B878000-memory.dmp
memory/3536-17-0x000002095B880000-0x000002095B9DE000-memory.dmp
memory/3536-11-0x000002095C3A0000-0x000002095D327000-memory.dmp
memory/3536-8-0x0000000180000000-0x0000000180A25000-memory.dmp
memory/3536-211-0x0000020965AE0000-0x0000020965AEA000-memory.dmp
memory/3536-3093-0x000002093A8C0000-0x000002093A8D2000-memory.dmp