File name:

RobloxPlayerInstaller (1).exe

Full analysis: https://app.any.run/tasks/ef1e6fb7-6e52-4593-963d-7f51db14d5ae
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: November 11, 2023, 21:40:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
xworm
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

37EC55EEB0B04A839448FCFD2C6983A5

SHA1:

3BD81C304205C26F9F57743F3F28800616592E27

SHA256:

96417538D88966725792BA8C3EE0AB841EF60CC0F70213CEDBEF66612274176A

SSDEEP:

3072:lJ4FoXtrlqb/XCVj2DZZ+erOgZkSVKVHVVwpsWm8YaV2E8tPtTemUFN:la+lqb/yVQZtZrVKVHVV9s2btPQmUF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • RobloxPlayerInstaller (1).exe (PID: 3460)

    • Create files in the Startup directory

      • RobloxPlayerInstaller (1).exe (PID: 3460)

    • XWORM has been detected (YARA)

      • RobloxPlayerInstaller (1).exe (PID: 3460)

    • Connects to the CnC server

      • RobloxPlayerInstaller (1).exe (PID: 3460)

    • XWORM has been detected (SURICATA)

      • RobloxPlayerInstaller (1).exe (PID: 3460)

  • SUSPICIOUS

    • Reads the Internet Settings

      • RobloxPlayerInstaller (1).exe (PID: 3460)

    • Checks for external IP

      • RobloxPlayerInstaller (1).exe (PID: 3460)

    • Connects to unusual port

      • RobloxPlayerInstaller (1).exe (PID: 3460)

  • INFO

    • Reads the computer name

      • RobloxPlayerInstaller (1).exe (PID: 3460)
      • wmpnscfg.exe (PID: 3500)

    • Reads the machine GUID from the registry

      • RobloxPlayerInstaller (1).exe (PID: 3460)
      • wmpnscfg.exe (PID: 3500)

    • Checks supported languages

      • RobloxPlayerInstaller (1).exe (PID: 3460)
      • wmpnscfg.exe (PID: 3500)

    • Create files in a temporary directory

      • RobloxPlayerInstaller (1).exe (PID: 3460)

    • Reads Environment values

      • RobloxPlayerInstaller (1).exe (PID: 3460)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3500)

    • Creates files or folders in the user directory

      • RobloxPlayerInstaller (1).exe (PID: 3460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(3460) RobloxPlayerInstaller (1).exe
C2127.0.0.1,Pulseating-47785.portmap.host:47785
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.0
MutexuKlt9pvXAjDSeOkU
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:11 22:40:43+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 77312
InitializedDataSize: 84992
UninitializedDataSize: -
EntryPoint: 0x14d6e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.56855
ProductVersionNumber: 1.6.0.56855
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Roblox Corporation
FileDescription: Roblox
FileVersion: 1.6.0.56855
InternalName: RobloxPlayerInstaller.exe
LegalCopyright: Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFileName: RobloxPlayerInstaller.exe
ProductName: Roblox Bootstrapper
ProductVersion: 1.6.0.56855
AssemblyVersion: 1.6.0.56855
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XWORM robloxplayerinstaller (1).exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3460"C:\Users\admin\AppData\Local\Temp\RobloxPlayerInstaller (1).exe" C:\Users\admin\AppData\Local\Temp\RobloxPlayerInstaller (1).exe
explorer.exe
User:
admin
Company:
Roblox Corporation
Integrity Level:
MEDIUM
Description:
Roblox
Exit code:
0
Version:
1.6.0.56855
Modules
Images
c:\users\admin\appdata\local\temp\robloxplayerinstaller (1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
XWorm
(PID) Process(3460) RobloxPlayerInstaller (1).exe
C2127.0.0.1,Pulseating-47785.portmap.host:47785
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.0
MutexuKlt9pvXAjDSeOkU
3500"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
1 210
Read events
1 207
Write events
0
Delete events
3

Modification events

(PID) Process:(3500) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{62DD8567-1C38-486E-9E48-1C2AFD650F43}\{620E6E4B-8A58-423A-B1EC-F5A40373A9A8}
Operation:delete keyName:(default)
Value:
(PID) Process:(3500) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{62DD8567-1C38-486E-9E48-1C2AFD650F43}
Operation:delete keyName:(default)
Value:
(PID) Process:(3500) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{556653C8-2ED4-4F0E-B6FE-A7DC76B97579}
Operation:delete keyName:(default)
Value:
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3460RobloxPlayerInstaller (1).exeC:\Users\admin\AppData\Local\Temp\RobloxPlayerInstallerexecutable
MD5:37EC55EEB0B04A839448FCFD2C6983A5
SHA256:96417538D88966725792BA8C3EE0AB841EF60CC0F70213CEDBEF66612274176A
3460RobloxPlayerInstaller (1).exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RobloxPlayerInstaller.lnkbinary
MD5:0530955EA8F2B9DDF3EFC62CD544B82A
SHA256:AA799F4A3C0EA6A6E23BE4D1E15C402A9B6DE655B0FF822CE7E1896A5E0DB40B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
3
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3460
RobloxPlayerInstaller (1).exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
text
6 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3460
RobloxPlayerInstaller (1).exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
868
svchost.exe
95.101.148.135:80
—
Akamai International B.V.
NL
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
868
svchost.exe
23.218.208.137:80
armmf.adobe.com
AKAMAI-AS
DE
unknown
3460
RobloxPlayerInstaller (1).exe
193.161.193.99:47785
Pulseating-47785.portmap.host
OOO Bitree Networks
RU
malicious

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared
armmf.adobe.com
  • 23.218.208.137
whitelisted
Pulseating-47785.portmap.host
  • 193.161.193.99
unknown

Threats

PID
Process
Class
Message
3460
RobloxPlayerInstaller (1).exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
3460
RobloxPlayerInstaller (1).exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
3460
RobloxPlayerInstaller (1).exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
1080
svchost.exe
Potential Corporate Privacy Violation
ET POLICY DNS Query to a Reverse Proxy Service Observed
1080
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host)
3460
RobloxPlayerInstaller (1).exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm
6 ETPRO signatures available at the full report
Process
Message
RobloxPlayerInstaller (1).exe
System.ArgumentException: Parameter is not valid. at System.Drawing.Bitmap..ctor(Int32 width, Int32 height, PixelFormat format) at System.Drawing.Bitmap..ctor(Image original, Int32 width, Int32 height) at System.Drawing.Bitmap..ctor(Image original, Size newSize) at Plugin.RemoteDesktop.Capture(Size size, Int32 Q)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RobloxPlayerInstaller (1).exe