Overview

overview

7

Static

static

3

RobloxPlay...4).exe

windows10-2004-x64

7

RobloxPlay...4).exe

windows10-ltsc_2021-x64

7

RobloxPlay...4).exe

windows11-21h2-x64

7

RobloxPlay...4).exe

windows11-ltsc_2024-x64

7

RobloxPlay...4).exe

android-10-x64

RobloxPlay...4).exe

android-11-x64

RobloxPlay...4).exe

android-13-x64

RobloxPlay...4).exe

android-14-x64

RobloxPlay...4).exe

android-15-x64

RobloxPlay...4).exe

android-9-x86

RobloxPlay...4).exe

macos-10.15-amd64

1

RobloxPlay...4).exe

debian-12-armhf

RobloxPlay...4).exe

debian-12-mipsel

RobloxPlay...4).exe

debian-9-armhf

RobloxPlay...4).exe

debian-9-mips

RobloxPlay...4).exe

debian-9-mipsel

RobloxPlay...4).exe

ubuntu-18.04-amd64

RobloxPlay...4).exe

ubuntu-20.04-amd64

RobloxPlay...4).exe

ubuntu-22.04-amd64

RobloxPlay...4).exe

ubuntu-24.04-amd64

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260911-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    02/11/2026, 02:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RobloxPlayerInstaller (4).exe
  • Size 13.2MB
  • Sample261102-c62era119m
  • SHA256 19c68344c5e95d70bb59475a696838b50d94216ccdbb6c27c6c29e4d729c0171
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 3 IoCs
    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (4).exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (4).exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Reads the TCP/IP host and domain name from the registry
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3680
    • C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
      "C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3680
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3220

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        RobloxStudioInstaller.exe
        • Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
        • Size 13.1MB
        • SHA256 f52514b1b91376ff9ac66f49d16f7cbda4096d44fcfe3dbb662a2b8547dac9b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RobloxPlayerBeta.dll
        • Path C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.dll
        • Size 16.9MB
        • SHA256 b5e81e0cf070efa2ee8024bcd180156a5bdaddc56d0d1f4a9bc620b8753761de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download