File name:

Roblx Cheats .exe

Full analysis: https://app.any.run/tasks/f5e70cce-d0cc-4a7c-9d2d-fde2821bf499
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: December 02, 2023, 14:10:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

82D5D2D666446A7DF24D9824AF9884B8

SHA1:

1BEF21FC971110F52AE801DDDE2EBC27A50A60A7

SHA256:

0383785DEB9DB9CC6A87F7B511C8D855FAB95DB937611F3DBF33393B2EF6A345

SSDEEP:

384:7GaqtREU9twsodxOvC4XeK99KjGn2pssIJqqah0I8ZumTG3IBL+EcoinblneHQM+:UtREWmOvbXe8IGnLJqqiD8ZuSNuzfcI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Roblx Cheats .exe (PID: 2644)

    • Drops the executable file immediately after the start

      • Roblx Cheats .exe (PID: 2644)

    • Connects to the CnC server

      • Roblx Cheats .exe (PID: 2644)

    • NJRAT has been detected (SURICATA)

      • Roblx Cheats .exe (PID: 2644)

    • NJRAT has been detected (YARA)

      • Roblx Cheats .exe (PID: 2644)

    • Starts CMD.EXE for self-deleting

      • Roblx Cheats .exe (PID: 2644)

    • NjRAT is detected

      • Roblx Cheats .exe (PID: 2644)

    • Changes the autorun value in the registry

      • Roblx Cheats .exe (PID: 2644)

  • SUSPICIOUS

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Roblx Cheats .exe (PID: 2644)

    • Connects to unusual port

      • Roblx Cheats .exe (PID: 2644)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • Roblx Cheats .exe (PID: 2644)

    • Starts CMD.EXE for commands execution

      • Roblx Cheats .exe (PID: 2644)

  • INFO

    • Checks supported languages

      • Roblx Cheats .exe (PID: 2644)
      • wmpnscfg.exe (PID: 3592)

    • Reads the machine GUID from the registry

      • Roblx Cheats .exe (PID: 2644)

    • Creates files or folders in the user directory

      • Roblx Cheats .exe (PID: 2644)

    • Reads the computer name

      • Roblx Cheats .exe (PID: 2644)
      • wmpnscfg.exe (PID: 3592)

    • Reads Environment values

      • Roblx Cheats .exe (PID: 2644)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(2644) Roblx Cheats .exe
C245.153.230.56
Ports25264
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\73fcd7a7907fbbeafe1fb23fee56d70d
Splitter|'|'|
Versionim523
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:02 09:31:07+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 35840
InitializedDataSize: 1536
UninitializedDataSize: -
EntryPoint: 0xabbe
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #NJRAT roblx cheats .exe netsh.exe no specs wmpnscfg.exe no specs cmd.exe no specs netsh.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2644"C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe" C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\roblx cheats .exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(2644) Roblx Cheats .exe
C245.153.230.56
Ports25264
BotnetHacKed
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\73fcd7a7907fbbeafe1fb23fee56d70d
Splitter|'|'|
Versionim523
2740netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe" "Roblx Cheats .exe" ENABLEC:\Windows\System32\netsh.exe—Roblx Cheats .exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
3396ping 0 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
3408cmd.exe /k ping 0 & del "C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe" & exitC:\Windows\System32\cmd.exe—Roblx Cheats .exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3504netsh firewall delete allowedprogram "C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe"C:\Windows\System32\netsh.exe—Roblx Cheats .exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
3592"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
1 820
Read events
1 586
Write events
232
Delete events
2

Modification events

(PID) Process:(2740) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2644) Roblx Cheats .exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:73fcd7a7907fbbeafe1fb23fee56d70d
Value:
"C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe" ..
(PID) Process:(2644) Roblx Cheats .exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:73fcd7a7907fbbeafe1fb23fee56d70d
Value:
"C:\Users\admin\AppData\Local\Temp\Roblx Cheats .exe" ..
(PID) Process:(2644) Roblx Cheats .exeKey:HKEY_CURRENT_USER\Software\73fcd7a7907fbbeafe1fb23fee56d70d
Operation:delete keyName:(default)
Value:
(PID) Process:(3504) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2644Roblx Cheats .exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\73fcd7a7907fbbeafe1fb23fee56d70d.exeexecutable
MD5:82D5D2D666446A7DF24D9824AF9884B8
SHA256:0383785DEB9DB9CC6A87F7B511C8D855FAB95DB937611F3DBF33393B2EF6A345
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
9
DNS requests
0
Threats
13

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2644
Roblx Cheats .exe
45.153.230.56:25264
—
MIRholding B.V.
DE
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
2644
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
2644
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
2644
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
2644
Roblx Cheats .exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
9 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Roblx Cheats .exe