Overview
overview
10Static
static
10RGF-main/Input.zip
windows7-x64
1RGF-main/Input.zip
windows10-2004-x64
3RoBrute-ma...ute.py
ubuntu-18.04-amd64
RoBrute-ma...ute.py
debian-9-armhf
RoBrute-ma...ute.py
debian-9-mips
RoBrute-ma...ute.py
debian-9-mipsel
RoBrute-ma...Lib.py
windows7-x64
3RoBrute-ma...Lib.py
windows10-2004-x64
8RoBrute-ma...ib.pyc
windows7-x64
3RoBrute-ma...ib.pyc
windows10-2004-x64
8RoBrute-ma...cks.py
windows7-x64
3RoBrute-ma...cks.py
windows10-2004-x64
8RoBrute-ma...ks.pyc
windows7-x64
3RoBrute-ma...ks.pyc
windows10-2004-x64
8RGF-main/RBF.exe
windows7-x64
10RGF-main/RBF.exe
windows10-2004-x64
10Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
14/02/2025, 13:04
Behavioral task
behavioral1
Sample
RGF-main/Input.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RGF-main/Input.zip
Resource
win10v2004-20250211-en
Behavioral task
behavioral3
Sample
RoBrute-master/RoBrute.py
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral4
Sample
RoBrute-master/RoBrute.py
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral5
Sample
RoBrute-master/RoBrute.py
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral6
Sample
RoBrute-master/RoBrute.py
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral7
Sample
RoBrute-master/mainLib.py
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RoBrute-master/mainLib.py
Resource
win10v2004-20250211-en
Behavioral task
behavioral9
Sample
RoBrute-master/mainLib.pyc
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
RoBrute-master/mainLib.pyc
Resource
win10v2004-20250211-en
Behavioral task
behavioral11
Sample
RoBrute-master/socks.py
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
RoBrute-master/socks.py
Resource
win10v2004-20250207-en
Behavioral task
behavioral13
Sample
RoBrute-master/socks.pyc
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
RoBrute-master/socks.pyc
Resource
win10v2004-20250207-en
Behavioral task
behavioral15
Sample
RGF-main/RBF.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
RGF-main/RBF.exe
Resource
win10v2004-20250211-en
General
-
Target
RoBrute-master/mainLib.pyc
-
Size
806B
-
MD5
a69353c0a05226a823732ff09def0462
-
SHA1
29d202a58960848f8a74c52cc5e0f28c239cbe1d
-
SHA256
14db2c7373b04e3767f4210e473906661b5251afceb5f9e445ab276f13b51a01
-
SHA512
b40d9ec41b4ef60d7d84400d4bcbcf11d0f469bd0365e84ff4a6b92f0dc71e12fd1f7ee4af5dd7d47dc2bd4548ecb1e75631a20829717f7ab5c46e80ed8cdfaa
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2220 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2220 AcroRd32.exe 2220 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2056 wrote to memory of 1420 2056 cmd.exe 31 PID 2056 wrote to memory of 1420 2056 cmd.exe 31 PID 2056 wrote to memory of 1420 2056 cmd.exe 31 PID 1420 wrote to memory of 2220 1420 rundll32.exe 33 PID 1420 wrote to memory of 2220 1420 rundll32.exe 33 PID 1420 wrote to memory of 2220 1420 rundll32.exe 33 PID 1420 wrote to memory of 2220 1420 rundll32.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\RoBrute-master\mainLib.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RoBrute-master\mainLib.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RoBrute-master\mainLib.pyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2220
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD528976faa0cde17473413c35c9805372c
SHA1e4a37d73d1d841af99e7ae7a1ba92a5df0041f2e
SHA256abcde3f250ba16a033d9de4f06e6da72db3b5e238c383ed776af068f5c4e30ad
SHA5123b760cf8437a336ab18c2ba7a3b6a7a95ee6188371087135a0d6437c5d362feabe7cce265be59b8390870f0f20933ce032737bf4d03dc7bf7b46d99fcb283d87