Resubmissions
25/09/2026, 16:25
260925-txbleast6p725/09/2026, 15:54
260925-tcl7eafd561025/09/2026, 15:41
260925-s41nfa1y4l8Analysis
- max time kernel
898s - max time network
474s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
25/09/2026, 16:25
General
- Target RobloxShadeHost-Setup.exe
- Size 2.7MB
- Sample260925-txbleast6p
- SHA256 2fce29f92f34e0c2eda45fb44dc29fda17cf6577d0163b9c8e86bbb1d704bdbc
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxShadeHost-Setup.exe"C:\Users\Admin\AppData\Local\Temp\RobloxShadeHost-Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CRSMOLAGYF.tmp\RobloxShadeHost-Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-CRSMOLAGYF.tmp\RobloxShadeHost-Setup.tmp" /SL5="$40240,1120700,927744,C:\Users\Admin\AppData\Local\Temp\RobloxShadeHost-Setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_is7z.dll
RobloxShadeHost-Setup.tmp
memory/2004-0-0x0000000000CF0000-0x0000000000DE1000-memory.dmp
memory/2004-10-0x0000000000CF0000-0x0000000000DE1000-memory.dmp
memory/4100-5-0x0000000000950000-0x0000000000951000-memory.dmp
memory/4100-11-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-12-0x0000000000950000-0x0000000000951000-memory.dmp
memory/4100-14-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-22-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-24-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-26-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-28-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-30-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-32-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-34-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-36-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-38-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-40-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-42-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-44-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-46-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-48-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-50-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-52-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-54-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-56-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-58-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-60-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-62-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-64-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-66-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-68-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-70-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-72-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-74-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-76-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-78-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-80-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-82-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-84-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-86-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-88-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-90-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-92-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-94-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-96-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-98-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-100-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-102-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-104-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-106-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-108-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-110-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-112-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-114-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-116-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-118-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-120-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-122-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-124-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-126-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-128-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-130-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-132-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-134-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-136-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-138-0x0000000000960000-0x0000000000DAB000-memory.dmp
memory/4100-140-0x0000000000960000-0x0000000000DAB000-memory.dmp