Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
Deep Malware Analysis
top title background image
flash

RobloxPlayerLauncher.exe

Status: finished
Submission Time: 2023-10-04 20:56:14 +02:00
Malicious
Ransomware
Phishing
Trojan
Spyware
Evader
Agent Tesla, AgentTesla

Comments

Tags

  • agenttesla
  • exe

Details

  • Analysis ID:
    1319695
  • API (Web) ID:
    1319695
  • Analysis Started:
    2023-10-04 20:56:16 +02:00
  • Analysis Finished:
    2023-10-04 21:12:13 +02:00
  • MD5:
    24d26b7fadaa483ef7f53e22226abac3
  • SHA1:
    96352cf9d7669fd1a25bb3b80507dfe686c12fac
  • SHA256:
    a77c3003795e0256c94937337cec5be20d883849bd77f940956607cdf719e637
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Full Report Management Report IOC Report
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 18/36
malicious

IPs

IP Country Detection
132.226.8.169
 United States
128.116.102.4
 United States
20.114.58.89
 United States
Click to see the 9 hidden entries
128.116.102.8
 United States
23.75.56.161
 United States
23.199.47.144
 United States
104.21.88.34
 United States
20.99.184.37
 United States
13.107.42.16
 United States
8.8.8.8
 United States
23.199.47.143
 United States
20.99.133.109
 United States

URLs

Name Detection
https://setup.rbxcdn.com/version-9fd31cae223e4d53-content-fonts.zip_
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayer
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Click to see the 97 hidden entries
http://msedge.b.tlu.dl.d(
https://crashpad.chromium.org/bug/new
http://www.winimage.com/zLibDll1.2.11rbr
http://DynDns.com
http://ocsp.sectigo.com0
https://setup.rbxcdn.com/version-9fd31cae223e4d53-RobloxApp.zip
https://www.roblox.com/
https://www.roblox.com/install/GetInstallerCdns.ashx~t
https://ephemeralcounters.api.roblox.com/v1.0/SequenceStatistics/BatchAddToSequencesV2?apiKey=76E5A4
https://setup.rbxcdn.com/version-9fd31cae223e4d53-content-sounds.zip
https://127.0.0.14
https://go.microF
http://msedge.f.dl.deli
https://go.microA
http://msedge.f.tlu.dl.delivery.mp.m
https://upload.crashes.rbxinfra.com/postt=100(
https://setup.rbxcdn.com/version-9fd31cae223e4d53-content-fonts.zip
https://ephemeralcounters.api.roblox.com/v1.1/Counters/BatchIncrement?apiKey=76E5A40C-3AE1-4028-9F10
https://www.roblox.com/install/GetInstallerCdns.ashx
https://127.0.0.1
https://setup.rbxcdn.com/version-9fd31cae223e4d53-content-fonts.zipg
https://ephemeralcounters.api.roblox.com/40C-3AE1-4028-9F10-7C62520BD94F
https://www.roblox.com/install/GetInstallerCdns.ashxNs
https://ephemeralcounters.api.roblox.com/crosoft
http://www.roblox.com
https://sectigo.com/CPS0
https://ephemeralcounters.api.roblox.com/2
http://www.apache.org/licenses/LICENSE-2.0
https://setup.rbxcdn.com/T
https://www.roblox.com/ography
https://www.roblox.com/install/GetInstallerCdns.ashx_s
https://ephemeralcounters.api.roblox.com/_
https://upload.crashes.rbxination=RobloxChannel=production
https://setup.rbxcdn.com/D
https://127.0.0.1(
https://setup.rbxcdn.com/version-9fd31cae223e4d53-content-fonts.zip;
https://go.microw
http://cacerts.digicert.co
https://upload.crashes.rbxinfra.com/post
https://ephemeralcounters.api.roblox.com/
https://ecs.nel.measure.office.net?TenantId=EdgeUpdate&DestinationEndpoint=Edge-Prod-LAX31r5b&FrontE
https://go.microt
https://clientsettingscdn.roblox.com/http/tcpt
https://127.0.0.1Version2tion
https://curl.haxx.se/docs/http-cookies.html
http://Paltalk.com
https://setup.rbxcdn.com/version-9fd31cae223e4d53-content-avatar.zip
https://127.0.0.1WindowsBootstrapperRecoveryInstallerUrlWindowsBootstrapperAlternativeAdminKeyRegDel
http://msedge.b.tlu.dl.deliver
http://checkip.dyndns.org/
https://setup.rbxcdn.com/version-9fd31cae223e4d53-content-fonts.zip)
https://127.0.0.1WindowsBootstrapperRecoveryInstallerUrlWindowsBootstrapperAlternativeAdminKeyDeploy
http://tools.medialab.sciences-po.fr/iwanthue/index.php
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayerapiKey=76E5A40C-3AE1-4028-9F10-7
https://clientsettingscdn.roblox.com/F
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayer2%
https://go.micro%
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
https://upload.crashes.rbxinfra.com/postQ
https://upload.crashes.rbxinfra.com/postInstalltionTel
https://clientsettingscdn.roblox.com/?
https://rakishev.net
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapper
https://go.micro#
https://clientsettingscdn.roblox.com/v2/client-version/WindowsPlayerg
https://upload.crashes.rbxinfra.com/postP
https://ncs.roblox.com/upload
https://rakishev8.G
https://setup.rbxcdn.com/version-9fd31cae223e4d53-content-fonts.zip~m
https://upload.crashes.rbxinfra.com/postH
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
https://upload.crashes.rbxinfra.com/postToken
https://crashpad.chromium.org/
https://127.0.0.1bilityStringO
http://msedge.hCM
http://crl.ver)
https://ecsv2.roblox.com/client/pbeTelemetryV2UrlFFlagRolloutDuplicateRobloxTelemetryCountersEnabled
https://setup.rbxcdn.com/
http://Seg61GVnCFT.org
http://msedge.b.tlu.dl.d
https://go.micro
https://ncs.robl
https://upload.crashes.rbxinfra.com/postCrashPadUploadToBacktraceBaseUrla2440b0bfdada85f34d79b43839f
https://ecsv2.roblox.com/client/pbem
https://go.microS
http://Seg61GVnCFT.orgt-
https://ephemeralcounters.api.roblox.com/YR
https://upload.crashes.rbxinfra.com/poststK
https://assetdelivery.roblox.com/v1
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapperQ
http://msed.b.tlu.dl.delivery.mp.m
https://setup.rbxcdn.com/version-9fd31cae223e4d53-RobloxApp.zipd53
http://msedge.CB
https://127.0.0.1Version2tiona
http://msedge.b.tlu.dl.delivery.mp.microft.com/filestreamingse
https://clientsettingscdn.roblox.com/v2/settings/application/PCClientBootstrapperlh6u

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\version-9fd31cae223e4d53-extracontent-models[1].zip
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\cd77e0e77d698260809f8ae8b3993740 (copy)
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\cd77e0e77d698260809f8ae8b3993740.part
 Zip archive data, at least v2.0 to extract, compression method=store
 #
Click to see the 40 hidden entries
C:\ProgramData\Roblox\Downloads\roblox-player\e42a6697bf05466d4dba26c8fe476d2e (copy)
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\e42a6697bf05466d4dba26c8fe476d2e.part
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\f44a904db475e6b654c0fe539ac59ec2 (copy)
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\f44a904db475e6b654c0fe539ac59ec2.part
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\version-9fd31cae223e4d53-WebView2[1].zip
 Zip archive data, at least v2.0 to extract, compression method=deflate
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\version-9fd31cae223e4d53-extracontent-textures[1].zip
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\version-9fd31cae223e4d53-content-platform-fonts[1].zip
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\version-9fd31cae223e4d53-content-sounds[1].zip
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\ac88c0df7538cb9641cb87590aa8c592.part
 Zip archive data, at least v2.0 to extract, compression method=deflate
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\version-9fd31cae223e4d53-ssl[1].zip
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\version-9fd31cae223e4d53-WebView2RuntimeInstaller[1].zip
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\version-9fd31cae223e4d53-content-fonts[1].zip
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\version-9fd31cae223e4d53-extracontent-luapackages[1].zip
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\version-9fd31cae223e4d53-extracontent-places[1].zip
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\version-9fd31cae223e4d53-RobloxApp[1].zip
 Zip archive data, at least v2.0 to extract, compression method=deflate
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\version-9fd31cae223e4d53-content-sky[1].zip
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\version-9fd31cae223e4d53-extracontent-translations[1].zip
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\Users\user\AppData\Local\Temp\RBX-D2C14AA9\RobloxPlayerLauncher.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Roaming\Adobe\CGRC9JUK.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Roblox\Downloads\roblox-player\3306b5447ccc252705d7f40fdb82daf4.part
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\65TIMT14.exe
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\ProgramData\Roblox\Downloads\roblox-player\04f3de22c9a3c82fc90a93f7bd2204e3 (copy)
 Zip archive data, at least v2.0 to extract, compression method=deflate
 #
C:\ProgramData\Roblox\Downloads\roblox-player\04f3de22c9a3c82fc90a93f7bd2204e3.part
 Zip archive data, at least v2.0 to extract, compression method=deflate
 #
C:\ProgramData\Roblox\Downloads\roblox-player\16823280f008152a109c48394c5bcb55 (copy)
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\16823280f008152a109c48394c5bcb55.part
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6 (copy)
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\1d0390337d1a4a58e5514be1a9481ad6.part
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\22fb392f0a96aadf0f07746a01a15da4 (copy)
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\22fb392f0a96aadf0f07746a01a15da4.part
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\3306b5447ccc252705d7f40fdb82daf4 (copy)
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\Program Files (x86)\Microsoft\Temp\EUD7AD.tmp\MicrosoftEdgeUpdate.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\ProgramData\Roblox\Downloads\roblox-player\59a950e2a51e3d27ca0c5662c6a22f8b (copy)
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\59a950e2a51e3d27ca0c5662c6a22f8b.part
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\648b52dfadca0ed7226280a9b72b1490 (copy)
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\648b52dfadca0ed7226280a9b72b1490.part
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\80915dd079442a38dc077e1ff6c7c7d7 (copy)
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\80915dd079442a38dc077e1ff6c7c7d7.part
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\8f379ec2b22ff106b837d79f7fdbf0d8 (copy)
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\8f379ec2b22ff106b837d79f7fdbf0d8.part
 Zip archive data, at least v2.0 to extract, compression method=store
 #
C:\ProgramData\Roblox\Downloads\roblox-player\ac88c0df7538cb9641cb87590aa8c592 (copy)
 Zip archive data, at least v2.0 to extract, compression method=deflate
 #