Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 14:21
General
- Target Roblox Account Manager.exe
- Size 5.4MB
- Sample260910-rphnmsdl41
- SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RAMTheme.ini
Roblox Account Manager.exe.config
log4.config
memory/1032-1-0x0000000000F20000-0x000000000148C000-memory.dmp
memory/1032-2-0x0000000006590000-0x0000000006B4A000-memory.dmp
memory/1032-3-0x0000000005DE0000-0x0000000005E26000-memory.dmp
memory/1032-4-0x0000000074F00000-0x00000000756BC000-memory.dmp
memory/1032-5-0x0000000005FD0000-0x0000000006062000-memory.dmp
memory/1032-6-0x0000000005EC0000-0x0000000005EE6000-memory.dmp
memory/1032-7-0x0000000005F00000-0x0000000005F1E000-memory.dmp
memory/1032-13-0x0000000074F00000-0x00000000756BC000-memory.dmp
memory/1032-0-0x0000000074F12000-0x0000000074F13000-memory.dmp
memory/3912-21-0x0000000074F00000-0x00000000756BC000-memory.dmp
memory/3912-34-0x000000000DB70000-0x000000000DC64000-memory.dmp
memory/3912-19-0x0000000006E70000-0x0000000006E7A000-memory.dmp
memory/3912-16-0x0000000074F00000-0x00000000756BC000-memory.dmp
memory/3912-14-0x0000000074F00000-0x00000000756BC000-memory.dmp
memory/3912-22-0x0000000074F00000-0x00000000756BC000-memory.dmp
memory/3912-23-0x000000000C340000-0x000000000C37A000-memory.dmp
memory/3912-24-0x000000000CAB0000-0x000000000CABA000-memory.dmp
memory/3912-25-0x000000000CAE0000-0x000000000CB80000-memory.dmp
memory/3912-30-0x000000000AB00000-0x000000000AB58000-memory.dmp
memory/3912-32-0x000000000CFD0000-0x000000000D082000-memory.dmp
memory/3912-18-0x0000000006DF0000-0x0000000006E64000-memory.dmp
memory/3912-33-0x000000000DA00000-0x000000000DA22000-memory.dmp
memory/3912-35-0x000000000DC60000-0x000000000DC7A000-memory.dmp
memory/3912-36-0x000000000DCA0000-0x000000000DCA8000-memory.dmp
memory/3912-39-0x000000000E410000-0x000000000E422000-memory.dmp
memory/3912-38-0x000000000E3E0000-0x000000000E3EA000-memory.dmp
memory/3912-46-0x0000000074F00000-0x00000000756BC000-memory.dmp
memory/3912-53-0x0000000074F00000-0x00000000756BC000-memory.dmp
memory/3912-207-0x0000000074F00000-0x00000000756BC000-memory.dmp
memory/3912-211-0x0000000074F00000-0x00000000756BC000-memory.dmp