d33a81e5b1c9f133d34b130df9681a3660b0a14c2237446044691d4bbab724be

Resubmissions

30/09/2026, 10:06

260930-l4869aws2q10

30/09/2026, 00:37

260930-ay1r5sysby10

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 00:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RobloxFree/RPGRobloxExt.exe
Size 1.5MB
Sample260930-ay1r5sysby
SHA256 d33a81e5b1c9f133d34b130df9681a3660b0a14c2237446044691d4bbab724be
MD5 abbe13fe1fc88f1abd2136aba92d003e
SHA1 d812e703fa348191452fda7f3ca593859605decf
SHA512 110d597c07db95773e36b2e4869bcb608e633f5253d7c0019de7b4202d089b282881049fc210ad564186cfe808ca5231565635a66069764e5880b094586e1e27
SSDEEP 24576:NhgadT9ORy7PW+8Za6t6UVHediZvYANErnk7WCxYZHSkh0edVjt0L0z+k7x2J:Dg+j7uW6gcrtYACnQY5needoL0z+kW
TLSH
T1E665E045B2F810FDD02BD135D986A60BEA72381817304DEB53E159992FB37E09BBB712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion privilege_escalation

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 4828 created 3508	4828	DX11_Runtimes.exe	86
PID 4828 created 3508	4828	DX11_Runtimes.exe	86

Executes dropped EXE 3 IoCs

pid	Process
4828	DX11_Runtimes.exe
2700	DX11_Runtimes.exe
2320	DX11_Runtimes.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4828 set thread context of 2700	4828	DX11_Runtimes.exe	89
PID 4828 set thread context of 2320	4828	DX11_Runtimes.exe	90

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe
3508	RPGRobloxExt.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 4828	3508	RPGRobloxExt.exe	88
PID 4828 wrote to memory of 2700	4828	DX11_Runtimes.exe	89
PID 4828 wrote to memory of 2700	4828	DX11_Runtimes.exe	89
PID 4828 wrote to memory of 2700	4828	DX11_Runtimes.exe	89
PID 4828 wrote to memory of 2700	4828	DX11_Runtimes.exe	89
PID 4828 wrote to memory of 2700	4828	DX11_Runtimes.exe	89
PID 4828 wrote to memory of 2700	4828	DX11_Runtimes.exe	89
PID 4828 wrote to memory of 2700	4828	DX11_Runtimes.exe	89
PID 4828 wrote to memory of 2700	4828	DX11_Runtimes.exe	89
PID 4828 wrote to memory of 2700	4828	DX11_Runtimes.exe	89
PID 4828 wrote to memory of 2320	4828	DX11_Runtimes.exe	90
PID 4828 wrote to memory of 2320	4828	DX11_Runtimes.exe	90
PID 4828 wrote to memory of 2320	4828	DX11_Runtimes.exe	90
PID 4828 wrote to memory of 2320	4828	DX11_Runtimes.exe	90
PID 4828 wrote to memory of 2320	4828	DX11_Runtimes.exe	90
PID 4828 wrote to memory of 2320	4828	DX11_Runtimes.exe	90
PID 4828 wrote to memory of 2320	4828	DX11_Runtimes.exe	90
PID 4828 wrote to memory of 2320	4828	DX11_Runtimes.exe	90
PID 4828 wrote to memory of 2320	4828	DX11_Runtimes.exe	90

C:\Users\Admin\AppData\Local\Temp\RobloxFree\RPGRobloxExt.exe
"C:\Users\Admin\AppData\Local\Temp\RobloxFree\RPGRobloxExt.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Users\Admin\AppData\Local\RPGUSAFE\DX11_Runtimes.exe
  "C:\Users\Admin\AppData\Local\RPGUSAFE\DX11_Runtimes.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4828
- C:\Users\Admin\AppData\Local\RPGUSAFE\DX11_Runtimes.exe
  "C:\Users\Admin\AppData\Local\RPGUSAFE\DX11_Runtimes.exe"
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Users\Admin\AppData\Local\RPGUSAFE\DX11_Runtimes.exe
  "C:\Users\Admin\AppData\Local\RPGUSAFE\DX11_Runtimes.exe"
  2⤵
  - Executes dropped EXE
  PID:2320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DX11_Runtimes.exe

Path C:\Users\Admin\AppData\Local\RPGUSAFE\DX11_Runtimes.exe
Size 508KB
SHA256 b9567d54fea33c2bb7d445a4f92561dfc2f22c1c3753993936282dae865bd0c5
MD5 fa33560519dbc0b5d2cafc9eef52d3ce
SHA1 8073e3123e77a68ed6642541655bc6e18b5f6c12
SHA512 0b6408ee9d2f423ef9d4963f526d81946dd76339b38e8e98860106756246d958af68d7e4bf6ab8a0fc70fefb0c8006349cb1ae7277a9692ab71b052d9cd4cc5c
SSDEEP 12288:w3MpGSj4h0eRbVv8omBitqut0xFOlSJG4K+kbvfZ20m0:wHSkh0edVjt0L0z+k7x2J
TLSH
T108B423C885D9AC8DD8CE0377FCAA25829690F83DD9131A9BED53DC29BE157094F24868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2320-20-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2320-17-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2320-21-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2320-23-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2320-28-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2320-27-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2320-19-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2320-18-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2320-14-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2320-16-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2700-26-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2700-22-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2700-13-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2700-12-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2700-11-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2700-10-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2700-25-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2700-6-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2700-9-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/2700-8-0x0000000140000000-0x0000000140040000-memory.dmp

Download

memory/4828-5-0x0000000002930000-0x00000000029B0000-memory.dmp

Download

memory/4828-4-0x0000000000210000-0x0000000000294000-memory.dmp

Download