633992ab1b7346333f925b4c35a647ab863539667b44aa1e0eded40fc3553581

Analysis

user interaction
yes
max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox-External.exe
Size 1.4MB
Sample261113-dbm5bafv4m
SHA256 633992ab1b7346333f925b4c35a647ab863539667b44aa1e0eded40fc3553581
MD5 0b31ba5a2dce1a69d5e5f9cc48d62120
SHA1 e9a3f989026128195ce2c5e43c8a5430fd8f69c3
SHA512 abcd245096bd93756fd1af7acd406d34f90a321c7f8b4c4e00d253a1e7d43fda8036b270b6465109fc8bea8d5c718cc8f5b75ba8bb3c8886ac46b3d7371ecfb6
SSDEEP 24576:DZnmVlM9kz4uq4skRtP6rS+8PZonYOKvqQttFEkLFr4GzvsGBMEYFn0DbK8kBo+n:sVlP4uq9kRtP8S+qZjOKvqQ49n0Db+Hn
TLSH
T18C65AE4BF6A505FCD47BC178C95AAA17EA76340C033099EF13E00A952F637E45A7BB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe	RuntimeBroker.exe

Executes dropped EXE 1 IoCs

pid	Process
2040	RuntimeBroker.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	RuntimeBroker.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2040	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 2040	3960	Roblox-External.exe	89

C:\Users\Admin\AppData\Local\Temp\Roblox-External.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox-External.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe
Size 1.4MB
SHA256 633992ab1b7346333f925b4c35a647ab863539667b44aa1e0eded40fc3553581
MD5 0b31ba5a2dce1a69d5e5f9cc48d62120
SHA1 e9a3f989026128195ce2c5e43c8a5430fd8f69c3
SHA512 abcd245096bd93756fd1af7acd406d34f90a321c7f8b4c4e00d253a1e7d43fda8036b270b6465109fc8bea8d5c718cc8f5b75ba8bb3c8886ac46b3d7371ecfb6
SSDEEP 24576:DZnmVlM9kz4uq4skRtP6rS+8PZonYOKvqQttFEkLFr4GzvsGBMEYFn0DbK8kBo+n:sVlP4uq9kRtP8S+qZjOKvqQ49n0Db+Hn
TLSH
T18C65AE4BF6A505FCD47BC178C95AAA17EA76340C033099EF13E00A952F637E45A7BB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download