Analysis
- user interaction
yes - max time kernel
20s - max time network
21s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
10/09/2026, 16:48
General
- Target R0B0T.exe
- Size 13.5MB
- Sample260910-va3baaek31
- SHA256 f2939e7d632383f498b14d0e6c1f9a97b2d58b59398b23ba4524077ce32f8d1d
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\R0B0T.exe"C:\Users\Admin\AppData\Local\Temp\R0B0T.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4988-0-0x0000000007330000-0x0000000007340000-memory.dmp
memory/4988-1-0x00000000080C0000-0x0000000008E3A000-memory.dmp
memory/4988-2-0x0000000007330000-0x0000000007340000-memory.dmp
memory/4988-3-0x0000000007340000-0x00000000078E6000-memory.dmp
memory/4988-4-0x0000000008E40000-0x0000000009BBA000-memory.dmp
memory/4988-5-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-8-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-6-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-13-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-15-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-16-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-11-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-18-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-20-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-26-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-33-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-34-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-30-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-29-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-22-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-24-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-38-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-62-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-58-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-56-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-55-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-52-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-60-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-44-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-42-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-36-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-51-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-49-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-46-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-40-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-70-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-80-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-78-0x0000000008E40000-0x0000000009BB3000-memory.dmp
memory/4988-82-0x0000000008E40000-0x0000000009BB3000-memory.dmp