4f5f52fbc9e5932fa350f2510cfcf5a9a8c7ef31a02ea63efb28b377394d4497

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

RBot v4.3 Installer.exe
Size

8KB
MD5

467541e4db45ad1012cbd4f018c725ad
SHA1

b79edc8ab2c8b821a7a6338b6aa2bb145e538eb9
SHA256

40304d57d1e839cc624080ef4cb137a2f42818eefea35e8af33fad536aa76093
SHA512

395ad18c7a357e5d75ee2f2a5e399d88a81c8d4dfd0e84fa878862422eae1568d7e7b87e367081ecbe3a92addfa74fc1ab78695fc663c0f95e375667a857ac1a
SSDEEP

192:8PReEVQ7aS7UPbj1HwzEqsE9RJVFuj6gD:+RTQaS7UPbj1QzHsEbJVm6g

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	discord.com
3	discord.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2504	2872	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2872	RBot v4.3 Installer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2504	2872	RBot v4.3 Installer.exe	28
PID 2872 wrote to memory of 2504	2872	RBot v4.3 Installer.exe	28
PID 2872 wrote to memory of 2504	2872	RBot v4.3 Installer.exe	28
PID 2872 wrote to memory of 2504	2872	RBot v4.3 Installer.exe	28

C:\Users\Admin\AppData\Local\Temp\RBot v4.3 Installer.exe
"C:\Users\Admin\AppData\Local\Temp\RBot v4.3 Installer.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 976
  2⤵
  - Program crash
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2872-0-0x0000000000B40000-0x0000000000B48000-memory.dmp

Filesize
32KB

Download
memory/2872-1-0x0000000073CF0000-0x00000000743DE000-memory.dmp

Filesize
6.9MB

Download
memory/2872-2-0x0000000004BE0000-0x0000000004C20000-memory.dmp

Filesize
256KB

Download
memory/2872-3-0x0000000073CF0000-0x00000000743DE000-memory.dmp

Filesize
6.9MB

Download