Procedure examples

RogueRobin gathers the IP address and domain from the victim’s machine.

The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in `Invoke-Obfuscation`.

RogueRobin collects the victim’s username and whether that user is an admin.

RogueRobin uses various WMI queries to check if the sample is running in a sandbox.

RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.

RogueRobin uses a command prompt to run a PowerShell script from Excel. To assist in establishing persistence, RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File “%APPDATA%\OneDrive.ps1”.

RogueRobin uses Windows Script Components.

RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.

RogueRobin has used Google Drive as a Command and Control channel.

RogueRobin can save a new file to the system from the C2 server.

RogueRobin has a command named $screenshot that may be responsible for taking screenshots of the victim machine.

RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.

RogueRobin decodes an embedded executable using base64 and decompresses it.

RogueRobin uses regsvr32.exe to run a .sct file for execution.

RogueRobin uses WMI to check BIOS version for VBOX, bochs, qemu, virtualbox, and vm to check for evidence that the script might be executing within an analysis environment.

RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.

RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.

RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.