Analysis
- max time kernel
106s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 14:36
General
- Target roblox beam.ps1
- Size 51KB
- Sample260820-rywxmaygmd
- SHA256 4adbe64170f39c08652098830d7bc903c690b0ec5040c9f76fdd734e72b39bd5
Score
3/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\roblox beam.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F41⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/204-0-0x00007FF908AEF000-0x00007FF908AF0000-memory.dmp
memory/204-1-0x00007FF908960000-0x00007FF909304000-memory.dmp
memory/204-4-0x000001BBA0740000-0x000001BBA0762000-memory.dmp
memory/204-5-0x00007FF908960000-0x00007FF909304000-memory.dmp
memory/204-6-0x00007FF908960000-0x00007FF909304000-memory.dmp
memory/204-7-0x00007FF908960000-0x00007FF909304000-memory.dmp
memory/204-8-0x00007FF908960000-0x00007FF909304000-memory.dmp
memory/204-9-0x00007FF908960000-0x00007FF909304000-memory.dmp
memory/204-10-0x00007FF908960000-0x00007FF909304000-memory.dmp
memory/204-12-0x00007FF908960000-0x00007FF909304000-memory.dmp
memory/204-13-0x00007FF908960000-0x00007FF909304000-memory.dmp