Analysis
-
max time kernel
141s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2024 13:23
Static task
static1
Behavioral task
behavioral1
Sample
Robokits_USB_BT_18_ServoCon_Setup_V82.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Robokits_USB_BT_18_ServoCon_Setup_V82.exe
Resource
win10v2004-20240802-en
General
-
Target
Robokits_USB_BT_18_ServoCon_Setup_V82.exe
-
Size
3.1MB
-
MD5
e0017606ff7935c846769b617a522c90
-
SHA1
ccbc102781a64f7936310e8f25028101ac3ff353
-
SHA256
0226f723ff835d0b46269c1b896fa18fef0a8ed24dc3c72872dcf4cb45be90f9
-
SHA512
b904262e8eea28f2229f6b670cf0240314626a8736aa90ed86f7c254cbe461190f1ba0976794b08dd11242b577c29bf3b2d5d767d910ad48889697a0e0cc34c5
-
SSDEEP
49152:sN26FOnzGn6LJvqkwnpC+mWd6uIcc+vo7dP6dF/WPxDz0peWUiz8ahxkYu:s06FOznLo0+Dd6uxc+vqYdF/WPxDIXxI
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Robokits_USB_BT_18_ServoCon_Setup_V82.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation Robokits_USB_BT_18_ServoCon_Setup_V82.exe -
Executes dropped EXE 1 IoCs
Processes:
irsetup.exepid process 3856 irsetup.exe -
Loads dropped DLL 1 IoCs
Processes:
irsetup.exepid process 3856 irsetup.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe upx behavioral2/memory/3856-12-0x0000000000400000-0x00000000007CB000-memory.dmp upx behavioral2/memory/3856-26-0x0000000000400000-0x00000000007CB000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Robokits_USB_BT_18_ServoCon_Setup_V82.exeirsetup.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Robokits_USB_BT_18_ServoCon_Setup_V82.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language irsetup.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
irsetup.exepid process 3856 irsetup.exe 3856 irsetup.exe 3856 irsetup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Robokits_USB_BT_18_ServoCon_Setup_V82.exedescription pid process target process PID 3560 wrote to memory of 3856 3560 Robokits_USB_BT_18_ServoCon_Setup_V82.exe irsetup.exe PID 3560 wrote to memory of 3856 3560 Robokits_USB_BT_18_ServoCon_Setup_V82.exe irsetup.exe PID 3560 wrote to memory of 3856 3560 Robokits_USB_BT_18_ServoCon_Setup_V82.exe irsetup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Robokits_USB_BT_18_ServoCon_Setup_V82.exe"C:\Users\Admin\AppData\Local\Temp\Robokits_USB_BT_18_ServoCon_Setup_V82.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1742706 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\Robokits_USB_BT_18_ServoCon_Setup_V82.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-945322488-2060912225-3527527000-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5dec931e86140139380ea0df57cd132b6
SHA1b717fd548382064189c16cb94dda28b1967a5712
SHA2565ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9
SHA51214d594e88c4a1f0ec8bc1b4fe2d66e26358f907b1106c047ada35d500ca9e608f1ce5a57599453cf10f11f4d9f1948ced9056ce8bd944b16eca7e9b83e8b27af
-
Filesize
318KB
MD5b5fc476c1bf08d5161346cc7dd4cb0ba
SHA1280fac9cf711d93c95f6b80ac97d89cf5853c096
SHA25612cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650
SHA51217fa97f399287b941e958d2d42fe6adb62700b01d9dbe0c824604e8e06d903b330f9d7d8ffb109bfb7f6742f46e7e9cedad6981f0d94d629b8402d0a0174f697