rustybuer | c43a631eb31a304b75768afb7fddec73a61e3df1f476a616bd46184971c64989

Analysis

Target

6f9d943f88f715ff8a122d7b88af986c1a9f38f4484e48cde768cf22a5935efe.dll

Score

10^/10

rustybuer loader

Family

rustybuer

https://shipmentofficedepot.com/

RustyBuer
RustyBuer is a new variant of Buer loader written in Rust.
loader rustybuer

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	1956	rundll32.exe

Executes dropped EXE 1 IoCs

pid	Process
1344	srtherhaeth.eXe

Loads dropped DLL 9 IoCs

Program crash 1 IoCs

pid	pid_target	Process	procid_target
316	1344	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 5 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
316	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	316	WerFault.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1956	2044	rundll32.exe	27
PID 2044 wrote to memory of 1956	2044	rundll32.exe	27
PID 2044 wrote to memory of 1956	2044	rundll32.exe	27
PID 2044 wrote to memory of 1956	2044	rundll32.exe	27
PID 2044 wrote to memory of 1956	2044	rundll32.exe	27
PID 2044 wrote to memory of 1956	2044	rundll32.exe	27
PID 2044 wrote to memory of 1956	2044	rundll32.exe	27
PID 1956 wrote to memory of 1344	1956	rundll32.exe	30
PID 1956 wrote to memory of 1344	1956	rundll32.exe	30
PID 1956 wrote to memory of 1344	1956	rundll32.exe	30
PID 1956 wrote to memory of 1344	1956	rundll32.exe	30
PID 1344 wrote to memory of 316	1344	srtherhaeth.eXe	31
PID 1344 wrote to memory of 316	1344	srtherhaeth.eXe	31
PID 1344 wrote to memory of 316	1344	srtherhaeth.eXe	31
PID 1344 wrote to memory of 316	1344	srtherhaeth.eXe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f9d943f88f715ff8a122d7b88af986c1a9f38f4484e48cde768cf22a5935efe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f9d943f88f715ff8a122d7b88af986c1a9f38f4484e48cde768cf22a5935efe.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Users\Public\srtherhaeth.eXe
    C:\Users\Public\srtherhaeth.eXe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 396
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:316

memory/316-76-0x00000000001F0000-0x0000000000250000-memory.dmp

Filesize
384KB

Download
memory/1344-66-0x0000000002200000-0x0000000002366000-memory.dmp

Filesize
1.4MB

Download
memory/1344-65-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1956-60-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download