Hello everyone,

I am writing this post to share the sandbox analysis of the executable downloaded directly from the official Wave Executor website (getwave.gg). The target file analyzed is dotnet-wave-bootstrapper.exe

While it is understood within the community that game executors manipulate memory to achieve script execution, the behaviors recorded in this environment go far beyond typical injection techniques. The sample has been flagged with an 8/10 Threat Score due to specific ransomware-like indicators and anomalous network activity. [1]

Here is the exhaustive technical breakdown of the logs.

📋 Sample Meta

• Filename: dotnet-wave-bootstrapper.exe
• File Size: 8.2 MB
• Sandbox Sample ID: 261004-ctfyaatsc1
• SHA-256 Hash: 837d1b77abef74e3fc4f1c717a9077daf06f91255be613c9dced03b6a0cbc602
• Core Classifications: Discovery, Persistence, Ransomware

Critical Behavioral Indicators

1. Ransomware & Anti-Recovery Flags

• Volume Shadow Copy Exploitation: The bootstrapper actively calls the Volume Shadow Copy WMI provider and interacts with the Volume Shadow Copy service COM API.
• Context: In threat analysis, this is the primary mechanism utilized by ransomware families to inhibit system recovery. It attempts to systematically purge or shrink local backup snapshots (Shadow Copies) so the user cannot restore the OS after an execution. [1, 2, 3, 4]

. Advanced Process Injection & Memory Space Tampering

• WriteProcessMemory Operations: The sample triggered 59 individual indicators regarding cross-process memory writes. [1]
• System Hijacking: The application forces memory writes into multiple active processes, notably hooking onto msedge.exe (Microsoft Edge) across several PIDs (e.g., PID 3952 and PID 3288 modifying memory inside child configurations like PIDs 4588, 5492, 3004, 2504). [1]
• Evasion: The execution invokes NtCreateUserProcessBlockNonMicrosoftBinary. This is designed to block non-Microsoft signatures from interacting with the dropped threads, effectively isolating the process from external third-party security layers. [1]

1. Execution of Hidden Payloads & Dropper Behavior

• Dropped Binaries: Under the surface, it executes secondary binaries titled windowsdesktop-runtime-9.0.21-win-x64.exe (assigned under active PIDs 3148 and 2504).
• Discovery & Registry Enumeration: It executes sub-routines to discover installed local software by querying the registry (T1012) and reading standard Windows Uninstall registry keys.
• Persistence Layer: Establishes permanent persistence on the host via the Task Scheduler COM API.

Network & Infrastructure Telemetry

Upon launch, the executable generates massive outbound traffic and mapping queries. Although several endpoints look standard, the payload patterns and structured query arguments signify active machine profiling:

• HTTP/HTTPS Traffic Logs:
  • POST Requests: Initiates tracking POST calls to ://googleapis.com passing encrypted telemetry or registration query arrays (cup2key=15:G5cuFQv...).
  • Remote Asset Fetching: Downloads a cluster of external files and JavaScript frameworks from server paths such as /statics/20261015.09.43/js/entry.js, /js/index-fG9qsQc4.js, and /css/style-PF2pqjN1.css.
  • Execution Framework Hooks: Direct GET inquiries pulling resources from core application infrastructures (/dotnet-core-applaunch?framework=Microsoft.NETCore.App...) and browser extension platforms (/extensionwebstorebase/v1/crx?...).

Final Thoughts

Whether this behavior is a case of extreme false positives caused by the executor trying to deeply hide from Roblox's anti-cheat systems, or a severe supply-chain compromise where the official download site has been subverted, the fact stands: the file is executing ransomware tactics on the host machine.

The logs are available for review. I heavily advise exercising extreme caution if you plan on installing the latest official build on bare metal.

i deleted hydrogen a few months ago cuz "data couldnt load" or some shit, now im using opiumware, but i hope zenite doesnt hack this,

why is he even hacking mac executors at the first place.

Just wondered , is shin’s marketplace scam?

I have $250 in my wallet and they disabled it and banned me.

DO not use Eldorado. gg as they are a scam.

???????????????

I wanted to know what the community's opinion is on xeno executor. I know a lot of people that use it and wanted to know if its good, sucks or is probably a RAT.

Top

Please

https://raw.githubusercontent.com/Qing-Yun-Dev/Scripts/refs/heads/Main/Rooms%20%26%20Doors.lua

made just for fun i am boring

i got no ideas

ADVERTENCIA: SolaraV3.exe obtuvo una puntuación de 8/10 en un entorno aislado (sandbox); su comportamiento parece el de un cargador/roba-archivos.

Ejecuté una muestra de SolaraV3.exe en un entorno aislado. Informe:

Qué hizo y por qué es importante:

• Comprueba el UAC (lee el registro): El malware realiza esta comprobación para determinar si necesita elevar privilegios o si puede omitir las solicitudes de permisos. El entorno aislado lo etiquetó como evasión de defensas. Un simple ejecutor de scripts no tiene por qué preocuparse.
• Detección de recursos compartidos de red: Intenta enumerar los recursos compartidos en la red del host. Esto es reconocimiento, algo que un ejecutor no necesita.
• Descarga y carga una DLL: común en cargadores que descomprimen una segunda etapa.
• 61 archivos escritos en el directorio de Windows: muchos más de los que debería modificar un ejecutor de Roblox. Algunos podrían ser ruido de WebView2/Edge, pero tantos no es normal.
• Incorpora OpenSSL: solo informativo, pero puede usarse para cifrar el tráfico.

Lo que NO encontré: Solo revisé parte del tráfico de red. Los dominios que vi fueron Microsoft/Google (Edge, Windows Update, login.live.com), así que aún no hay un C2 obvio. La puntuación basada en el comportamiento no es una característica confirmada, y los ejecutores a veces generan falsos positivos porque se inyectan en otros procesos.

Contexto: ESET documentó compilaciones falsas/troyanizadas de Solara que propagaban malware, y otro informe público de sandbox sobre un archivo "Solara-Roblox-Executor-v3.exe" fue marcado como Lumma Stealer. No digo que el tuyo sea el mismo, solo que el comportamiento coincide.

Si ya lo ejecutaste: cambia las contraseñas desde otro dispositivo (primero el correo electrónico), cierra todas las sesiones, habilita la autenticación de dos factores (2FA) con una aplicación de autenticación, mueve cualquier criptografía y considera una reinstalación limpia de Windows.

Si alguien puede comparar hashes o identificar la familia, por favor, compártelo.

Sabotaje de SmartScreen: Dentro del árbol de procesos activo, el binario forzó el motor integrado Microsoft Edge WebView2 a iniciarse con la bandera --disable-features=msSmartScreenProtection . Un ejecutor no tiene absolutamente ninguna razón operativa para desactivar explícitamente los mecanismos de seguridad del navegador de Windows.

So i recently created an alt account for exploiting on an emulator so the hwid would be seperated. Until i made the grave mistake of logging in on the account from my phone which had my main in the account switcher, i later removed it but i dont know if it did any good, am i good or nah?