Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/05/2026, 21:09
Behavioral task
behavioral1
Sample
brbbot_packed.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
brbbot_packed.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target brbbot_packed.exe
- Size 36KB
- Sample260519-zzrcjaft2p
- SHA256 f9227a44ea25a7ee8148e2d0532b14bb640f6dc52cb5b22a9f4fa7fa037417fa
- MD5 c6a4535a37f6adeac107b22d9d1220ba
- SHA1 fbcb05e331d91cdca0bd1410bead0d2e91c18e5d
- SHA512 8601012b4ab33d31e41f84a629d577f151fb03026ed559d86c0f684be3562a71214eb5d860971b08f14bd1cdccc01ee0dc2910eb83b1f70356ad87a4c5ce53d8
- SSDEEP 768:T/at+/UnTeesPcQaxXVphhygESmU/MdeupNpaursy:T6+8ncPgVphhwSmPeupD9rsy
- TLSH T1ABF2F176F5878F01CC1D637E63939FD192A93AE08205AB74560E120B3A96DA76CCA291
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
brbbot
C2
-
brb.3dtuts.by
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2392 brbbot_packed.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brbbot = "C:\\Users\\Admin\\AppData\\Roaming\\brbbot_packed.exe" brbbot_packed.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brbbot = "C:\\Users\\Admin\\AppData\\Roaming\\brbbot_packed.exe" brbbot_packed.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\brbconfig.tmp brbbot_packed.exe -
resource yara_rule behavioral2/memory/4304-0-0x00007FF63C2A0000-0x00007FF63C2BC000-memory.dmp upx behavioral2/files/0x001e00000002b275-5.dat upx behavioral2/memory/2392-6-0x00007FF73A9D0000-0x00007FF73A9EC000-memory.dmp upx behavioral2/memory/4304-9-0x00007FF63C2A0000-0x00007FF63C2BC000-memory.dmp upx behavioral2/memory/2392-11-0x00007FF73A9D0000-0x00007FF73A9EC000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 4304 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe 2392 brbbot_packed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\brbbot_packed.exe"C:\Users\Admin\AppData\Local\Temp\brbbot_packed.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4304
-
C:\Users\Admin\AppData\Roaming\brbbot_packed.exeC:\Users\Admin\AppData\Roaming\brbbot_packed.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:2392
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\brbbot_packed.exe
- Size 36KB
- SHA256 f9227a44ea25a7ee8148e2d0532b14bb640f6dc52cb5b22a9f4fa7fa037417fa
- MD5 c6a4535a37f6adeac107b22d9d1220ba
- SHA1 fbcb05e331d91cdca0bd1410bead0d2e91c18e5d
- SHA512 8601012b4ab33d31e41f84a629d577f151fb03026ed559d86c0f684be3562a71214eb5d860971b08f14bd1cdccc01ee0dc2910eb83b1f70356ad87a4c5ce53d8
- SSDEEP 768:T/at+/UnTeesPcQaxXVphhygESmU/MdeupNpaursy:T6+8ncPgVphhwSmPeupD9rsy
- TLSH T1ABF2F176F5878F01CC1D637E63939FD192A93AE08205AB74560E120B3A96DA76CCA291
- MD5 SHA1 SHA512 SSDEEP TLSH