Analysis
- user interaction
yes - max time kernel
12s - max time network
33s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/09/2026, 19:57
General
- Target Roblox Account Manager.exe
- Size 5.4MB
- Sample260926-ypr1msgc35
- SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe"C:\Users\Admin\AppData\Local\Temp\Roblox Account Manager.exe" -restart2⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\vcredist.tmp"C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" /q /norestart3⤵
-
C:\Windows\Temp\{37EDC240-390C-4344-9416-9C26EA05593C}\.cr\vcredist.tmp"C:\Windows\Temp\{37EDC240-390C-4344-9416-9C26EA05593C}\.cr\vcredist.tmp" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vcredist.tmp" -burn.filehandle.attached=752 -burn.filehandle.self=756 /q /norestart4⤵
-
C:\Windows\Temp\{CD752B48-1AEE-41A1-AB4E-6022158AFDA6}\.be\VC_redist.x86.exe"C:\Windows\Temp\{CD752B48-1AEE-41A1-AB4E-6022158AFDA6}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{42003294-8EE9-49EF-80C0-BAFDDC4EECCE} {2CDE3787-10C8-461C-B60A-4C2E18ECFD04} 30125⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RAMTheme.ini
Roblox Account Manager.exe.config
log4.config
vcredist.tmp
vcredist.tmp
logo.png
wixstdba.dll
VC_redist.x86.exe
VC_redist.x86.exe
memory/2660-23-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/2660-34-0x000000000D840000-0x000000000D8F2000-memory.dmp
memory/2660-89-0x000000000FFD0000-0x0000000010020000-memory.dmp
memory/2660-15-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/2660-18-0x0000000005FF0000-0x0000000006064000-memory.dmp
memory/2660-19-0x0000000005820000-0x000000000582A000-memory.dmp
memory/2660-91-0x0000000007530000-0x000000000788B000-memory.dmp
memory/2660-21-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/2660-22-0x000000000B620000-0x000000000B65A000-memory.dmp
memory/2660-90-0x000000000F160000-0x000000000F168000-memory.dmp
memory/2660-24-0x000000000BD90000-0x000000000BD9A000-memory.dmp
memory/2660-25-0x000000000BDC0000-0x000000000BE60000-memory.dmp
memory/2660-32-0x000000000D7B0000-0x000000000D808000-memory.dmp
memory/2660-14-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/2660-78-0x000000000F1A0000-0x000000000F1A8000-memory.dmp
memory/2660-77-0x000000000F170000-0x000000000F18A000-memory.dmp
memory/2660-75-0x000000000DA40000-0x000000000DA62000-memory.dmp
memory/2660-76-0x000000000F060000-0x000000000F154000-memory.dmp
memory/5792-6-0x00000000052B0000-0x00000000052D6000-memory.dmp
memory/5792-5-0x0000000005350000-0x00000000053E2000-memory.dmp
memory/5792-4-0x0000000005250000-0x0000000005296000-memory.dmp
memory/5792-3-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5792-0-0x0000000074CD2000-0x0000000074CD3000-memory.dmp
memory/5792-7-0x00000000052F0000-0x000000000530E000-memory.dmp
memory/5792-13-0x0000000074CC0000-0x000000007547C000-memory.dmp
memory/5792-2-0x00000000057B0000-0x0000000005D6A000-memory.dmp
memory/5792-1-0x00000000001C0000-0x000000000072C000-memory.dmp