| File name: | Roblox Account Manager.exe |
| Full analysis: | https://app.any.run/tasks/8bae7200-7ef4-4176-ba10-924486b3fb72 |
| Verdict: | Malicious activity |
| Analysis date: | August 09, 2024, 11:16:26 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | A057FAE0C8C97EE6CF2C12FB7BCF034D |
| SHA1: | 64FE0EB242B5C3F9C42F4F2C1685E4A36708E4F6 |
| SHA256: | CDB0A360CCA7A5099C2D2357BE1A833E032FFDEB3F467A6FAC845F6BB77031C9 |
| SSDEEP: | 98304:b2bT1Qm7d9GP4i7q0LTWgtUmWzmSyZs9S8Z/LywnrSkqXf0Fb7WnhNMYkj7z:4Qm59q/tUhzmS9zZ/mY+kSIb7ahNMYkX |
MALICIOUS
No malicious indicators.SUSPICIOUS
Drops the executable file immediately after the start
- Roblox Account Manager.exe (PID: 6396)
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6892)
Reads security settings of Internet Explorer
- Roblox Account Manager.exe (PID: 6396)
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6740)
- Roblox Account Manager.exe (PID: 4924)
- Roblox Account Manager.exe (PID: 5980)
Reads the date of Windows installation
- Roblox Account Manager.exe (PID: 6396)
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6740)
- Roblox Account Manager.exe (PID: 4924)
Application launched itself
- Roblox Account Manager.exe (PID: 6396)
- Auto Update.exe (PID: 6740)
- Roblox Account Manager.exe (PID: 4924)
Executable content was dropped or overwritten
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6892)
Starts itself from another location
- Roblox Account Manager.exe (PID: 6484)
Process drops legitimate windows executable
- Roblox Account Manager.exe (PID: 6484)
INFO
Checks supported languages
- Roblox Account Manager.exe (PID: 6396)
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6892)
- Auto Update.exe (PID: 6740)
- Roblox Account Manager.exe (PID: 4924)
- Roblox Account Manager.exe (PID: 5980)
Reads the computer name
- Roblox Account Manager.exe (PID: 6396)
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6740)
- Auto Update.exe (PID: 6892)
- Roblox Account Manager.exe (PID: 4924)
- Roblox Account Manager.exe (PID: 5980)
Reads the machine GUID from the registry
- Roblox Account Manager.exe (PID: 6396)
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6740)
- Auto Update.exe (PID: 6892)
- Roblox Account Manager.exe (PID: 4924)
- Roblox Account Manager.exe (PID: 5980)
Creates files in the program directory
- Roblox Account Manager.exe (PID: 6396)
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6892)
- Roblox Account Manager.exe (PID: 5980)
Process checks computer location settings
- Roblox Account Manager.exe (PID: 6396)
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6740)
- Roblox Account Manager.exe (PID: 4924)
Disables trace logs
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6892)
- Roblox Account Manager.exe (PID: 5980)
Checks proxy server information
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6892)
- Roblox Account Manager.exe (PID: 5980)
Creates files or folders in the user directory
- Roblox Account Manager.exe (PID: 6484)
- Roblox Account Manager.exe (PID: 5980)
Reads the software policy settings
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6892)
- Roblox Account Manager.exe (PID: 5980)
Reads Environment values
- Roblox Account Manager.exe (PID: 6484)
- Auto Update.exe (PID: 6892)
- Roblox Account Manager.exe (PID: 5980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2047:11:22 08:58:55+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 5446656 |
| InitializedDataSize: | 31232 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x533a7e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 3.6.1.0 |
| ProductVersionNumber: | 3.6.1.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | Created by ic3w0lf |
| CompanyName: | ic3 |
| FileDescription: | Roblox Account Manager |
| FileVersion: | 3.6.1.0 |
| InternalName: | Roblox Account Manager.exe |
| LegalCopyright: | Copyright © ic3 2023 |
| LegalTrademarks: | - |
| OriginalFileName: | Roblox Account Manager.exe |
| ProductName: | Roblox Account Manager |
| ProductVersion: | 3.6.1.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
136
Monitored processes
6
Malicious processes
2
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 4924 | "C:\Users\admin\Desktop\Roblox Account Manager.exe" | C:\Users\admin\Desktop\Roblox Account Manager.exe | — | Auto Update.exe | |||||||||||
User: admin Company: ic3 Integrity Level: MEDIUM Description: Roblox Account Manager Exit code: 0 Version: 3.7.2.0 Modules
| |||||||||||||||
| 5980 | "C:\Users\admin\Desktop\Roblox Account Manager.exe" -restart | C:\Users\admin\Desktop\Roblox Account Manager.exe | Roblox Account Manager.exe | ||||||||||||
User: admin Company: ic3 Integrity Level: MEDIUM Description: Roblox Account Manager Version: 3.7.2.0 Modules
| |||||||||||||||
| 6396 | "C:\Users\admin\Desktop\Roblox Account Manager.exe" | C:\Users\admin\Desktop\Roblox Account Manager.exe | — | explorer.exe | |||||||||||
User: admin Company: ic3 Integrity Level: MEDIUM Description: Roblox Account Manager Exit code: 0 Version: 3.6.1.0 Modules
| |||||||||||||||
| 6484 | "C:\Users\admin\Desktop\Roblox Account Manager.exe" -restart | C:\Users\admin\Desktop\Roblox Account Manager.exe | Roblox Account Manager.exe | ||||||||||||
User: admin Company: ic3 Integrity Level: MEDIUM Description: Roblox Account Manager Exit code: 1 Version: 3.6.1.0 Modules
| |||||||||||||||
| 6740 | "C:\Users\admin\Desktop\Auto Update.exe" -update | C:\Users\admin\Desktop\Auto Update.exe | — | Roblox Account Manager.exe | |||||||||||
User: admin Company: ic3 Integrity Level: MEDIUM Description: Roblox Account Manager Exit code: 0 Version: 3.6.1.0 Modules
| |||||||||||||||
| 6892 | "C:\Users\admin\Desktop\Auto Update.exe" -update | C:\Users\admin\Desktop\Auto Update.exe | Auto Update.exe | ||||||||||||
User: admin Company: ic3 Integrity Level: HIGH Description: Roblox Account Manager Exit code: 0 Version: 3.6.1.0 Modules
| |||||||||||||||
Total events
7 822
Read events
7 761
Write events
61
Delete events
0
Modification events
| (PID) Process: | (6396) Roblox Account Manager.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6396) Roblox Account Manager.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6396) Roblox Account Manager.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6396) Roblox Account Manager.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (6484) Roblox Account Manager.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (6484) Roblox Account Manager.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (6484) Roblox Account Manager.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (6484) Roblox Account Manager.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (6484) Roblox Account Manager.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (6484) Roblox Account Manager.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Roblox Account Manager_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
Executable files
5
Suspicious files
4
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6484 | Roblox Account Manager.exe | C:\Users\admin\Desktop\libsodium.dll | executable | |
MD5:4F6426E3626D5D46FB19C13043CB84DE | SHA256:7A960129F6D3F8D44B4C6BE27F587C29AA8BAFB9C4D3C85BB84A5F5D8FA6E2BA | |||
| 6484 | Roblox Account Manager.exe | C:\Users\admin\Desktop\log.txt | text | |
MD5:E8EC934C3BA1694A8A4FE48A6F45E9F3 | SHA256:34DFD70C323C8024886569FDA5DEF1F62CC57EE6914C8F56C019C14AD0D40C83 | |||
| 6892 | Auto Update.exe | C:\Users\admin\Desktop\Update.zip | compressed | |
MD5:D58B79CB3D3635BA963427362F75D075 | SHA256:49B2C015DA0851A2ED43820799A7BCDA08E1BC5F315E107598F87F4B1BD36DAC | |||
| 6396 | Roblox Account Manager.exe | C:\Users\admin\Desktop\Roblox Account Manager.exe.config | xml | |
MD5:7E067AFE7C779870C370C40240E2CE1F | SHA256:5E0BA1895CF088E6D6907B8ABBD8CD41C86F39CC642351A9AB0BF458BF1F5B31 | |||
| 6892 | Auto Update.exe | C:\Users\admin\Desktop\Roblox Account Manager.exe | executable | |
MD5:334728F32A1144C893FDFFC579A7709B | SHA256:BE9DDCDEDF8C36C64E6B0A32D2686B74A112913C54217CCAA46675BFD1DC82F1 | |||
| 6396 | Roblox Account Manager.exe | C:\Users\admin\Desktop\log4.config | xml | |
MD5:E4659AC08AF3582A23F38BF6C562F841 | SHA256:E4B10630D9EC2AF508DE31752FBBC6816C7426C40A3E57F0A085CE7F42C77BD5 | |||
| 6396 | Roblox Account Manager.exe | C:\Users\admin\Desktop\RAMTheme.ini | text | |
MD5:F18FA783F4D27E35E54E54417334BFB4 | SHA256:563EB35FD613F4298CD4DCEFF67652A13BA516A6244D9407C5709323C4CA4BB1 | |||
| 6484 | Roblox Account Manager.exe | C:\Users\admin\Desktop\Auto Update.exe | executable | |
MD5:A057FAE0C8C97EE6CF2C12FB7BCF034D | SHA256:CDB0A360CCA7A5099C2D2357BE1A833E032FFDEB3F467A6FAC845F6BB77031C9 | |||
| 6892 | Auto Update.exe | C:\Users\admin\Desktop\Update\Roblox Account Manager.exe | executable | |
MD5:334728F32A1144C893FDFFC579A7709B | SHA256:BE9DDCDEDF8C36C64E6B0A32D2686B74A112913C54217CCAA46675BFD1DC82F1 | |||
| 6892 | Auto Update.exe | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox Account Manager\Roblox Account Manager.lnk | binary | |
MD5:E5D251CBAF1C00162785AFDE09F2D7A1 | SHA256:CC511F52D76673FF3555DCD13B82C65987AE2C4D12319313E4E128E9D5F9E3E5 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
53
DNS requests
22
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1664 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1664 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7052 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
7092 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4056 | RUXIMICS.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4936 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4936 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6484 | Roblox Account Manager.exe | 140.82.121.5:443 | api.github.com | GITHUB | US | unknown |
6484 | Roblox Account Manager.exe | 128.116.44.4:443 | clientsettings.roblox.com | ROBLOX-PRODUCTION | US | malicious |
6484 | Roblox Account Manager.exe | 140.82.121.3:443 | github.com | GITHUB | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
clientsettings.roblox.com |
| whitelisted |
github.com |
| shared |
api.github.com |
| whitelisted |
storage.googleapis.com |
| whitelisted |
raw.githubusercontent.com |
| shared |
www.bing.com |
| whitelisted |
objects.githubusercontent.com |
| shared |
ocsp.digicert.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2256 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Attempting to access raw user content on GitHub |