rustybuer | c43a631eb31a304b75768afb7fddec73a61e3df1f476a616bd46184971c64989

Analysis

max time kernel
117s
max time network
57s
platform
windows7_x64
resource
win7v20210408
submitted
21-07-2021 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f9d943f88f715ff8a122d7b88af986c1a9f38f4484e48cde768cf22a5935efe.dll

Score

10^/10

rustybuer loader

Malware Config

Extracted

Family

rustybuer

https://shipmentofficedepot.com/

Signatures

RustyBuer
RustyBuer is a new variant of Buer loader written in Rust.
loader rustybuer
Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

2 1956 rundll32.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

srtherhaeth.eXe

pid process

1344 srtherhaeth.eXe
Loads dropped DLL 9 IoCs

Processes:

rundll32.exeWerFault.exe

pid process

1956 rundll32.exe
1956 rundll32.exe
316 WerFault.exe
316 WerFault.exe
316 WerFault.exe
316 WerFault.exe
316 WerFault.exe
316 WerFault.exe
316 WerFault.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

316 1344 WerFault.exe srtherhaeth.eXe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

WerFault.exe

pid process

316 WerFault.exe
316 WerFault.exe
316 WerFault.exe
316 WerFault.exe
316 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

316 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 316 WerFault.exe

flow	pid	process
2	1956	rundll32.exe

pid	process
1344	srtherhaeth.eXe

pid	process
1956	rundll32.exe
1956	rundll32.exe
316	WerFault.exe
316	WerFault.exe
316	WerFault.exe
316	WerFault.exe
316	WerFault.exe
316	WerFault.exe
316	WerFault.exe

pid	pid_target	process	target process
316	1344	WerFault.exe	srtherhaeth.eXe

pid	process
316	WerFault.exe
316	WerFault.exe
316	WerFault.exe
316	WerFault.exe
316	WerFault.exe

pid	process
316	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	316	WerFault.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

rundll32.exerundll32.exesrtherhaeth.eXe

description	pid	process	target process
PID 2044 wrote to memory of 1956	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1956	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1956	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1956	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1956	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1956	2044	rundll32.exe	rundll32.exe
PID 2044 wrote to memory of 1956	2044	rundll32.exe	rundll32.exe
PID 1956 wrote to memory of 1344	1956	rundll32.exe	srtherhaeth.eXe
PID 1956 wrote to memory of 1344	1956	rundll32.exe	srtherhaeth.eXe
PID 1956 wrote to memory of 1344	1956	rundll32.exe	srtherhaeth.eXe
PID 1956 wrote to memory of 1344	1956	rundll32.exe	srtherhaeth.eXe
PID 1344 wrote to memory of 316	1344	srtherhaeth.eXe	WerFault.exe
PID 1344 wrote to memory of 316	1344	srtherhaeth.eXe	WerFault.exe
PID 1344 wrote to memory of 316	1344	srtherhaeth.eXe	WerFault.exe
PID 1344 wrote to memory of 316	1344	srtherhaeth.eXe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f9d943f88f715ff8a122d7b88af986c1a9f38f4484e48cde768cf22a5935efe.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f9d943f88f715ff8a122d7b88af986c1a9f38f4484e48cde768cf22a5935efe.dll,#1
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956

C:\Users\Public\srtherhaeth.eXe
C:\Users\Public\srtherhaeth.eXe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 396
4⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\srtherhaeth.eXe
MD5
984287b2d5eb06be3bb771f84e3b5ee8

SHA1
c75b5e359169084504a78259fd79f0d1e86a19ef

SHA256
c28abaaad1b7b2c7a37f28e974e8214f07c88feffef986e0a60a44ab0fa575aa

SHA512
412af5359691a2caea5a4e452b9ed2603d31db6306cf1c0b375c5f67400769108bc89c047b080d96e8f647b6fb6a47bfe9d6c6a123a4f27839953cd624e7ff9a

Download Submit
C:\Users\Public\srtherhaeth.eXe
MD5
984287b2d5eb06be3bb771f84e3b5ee8

SHA1
c75b5e359169084504a78259fd79f0d1e86a19ef

SHA256
c28abaaad1b7b2c7a37f28e974e8214f07c88feffef986e0a60a44ab0fa575aa

SHA512
412af5359691a2caea5a4e452b9ed2603d31db6306cf1c0b375c5f67400769108bc89c047b080d96e8f647b6fb6a47bfe9d6c6a123a4f27839953cd624e7ff9a

Download Submit
\Users\Public\srtherhaeth.eXe
MD5
984287b2d5eb06be3bb771f84e3b5ee8

SHA1
c75b5e359169084504a78259fd79f0d1e86a19ef

SHA256
c28abaaad1b7b2c7a37f28e974e8214f07c88feffef986e0a60a44ab0fa575aa

SHA512
412af5359691a2caea5a4e452b9ed2603d31db6306cf1c0b375c5f67400769108bc89c047b080d96e8f647b6fb6a47bfe9d6c6a123a4f27839953cd624e7ff9a

Download Submit
\Users\Public\srtherhaeth.eXe
MD5
984287b2d5eb06be3bb771f84e3b5ee8

SHA1
c75b5e359169084504a78259fd79f0d1e86a19ef

SHA256
c28abaaad1b7b2c7a37f28e974e8214f07c88feffef986e0a60a44ab0fa575aa

SHA512
412af5359691a2caea5a4e452b9ed2603d31db6306cf1c0b375c5f67400769108bc89c047b080d96e8f647b6fb6a47bfe9d6c6a123a4f27839953cd624e7ff9a

Download Submit
\Users\Public\srtherhaeth.eXe
MD5
984287b2d5eb06be3bb771f84e3b5ee8

SHA1
c75b5e359169084504a78259fd79f0d1e86a19ef

SHA256
c28abaaad1b7b2c7a37f28e974e8214f07c88feffef986e0a60a44ab0fa575aa

SHA512
412af5359691a2caea5a4e452b9ed2603d31db6306cf1c0b375c5f67400769108bc89c047b080d96e8f647b6fb6a47bfe9d6c6a123a4f27839953cd624e7ff9a

Download Submit
\Users\Public\srtherhaeth.eXe
MD5
984287b2d5eb06be3bb771f84e3b5ee8

SHA1
c75b5e359169084504a78259fd79f0d1e86a19ef

SHA256
c28abaaad1b7b2c7a37f28e974e8214f07c88feffef986e0a60a44ab0fa575aa

SHA512
412af5359691a2caea5a4e452b9ed2603d31db6306cf1c0b375c5f67400769108bc89c047b080d96e8f647b6fb6a47bfe9d6c6a123a4f27839953cd624e7ff9a

Download Submit
\Users\Public\srtherhaeth.eXe
MD5
984287b2d5eb06be3bb771f84e3b5ee8

SHA1
c75b5e359169084504a78259fd79f0d1e86a19ef

SHA256
c28abaaad1b7b2c7a37f28e974e8214f07c88feffef986e0a60a44ab0fa575aa

SHA512
412af5359691a2caea5a4e452b9ed2603d31db6306cf1c0b375c5f67400769108bc89c047b080d96e8f647b6fb6a47bfe9d6c6a123a4f27839953cd624e7ff9a

Download Submit
\Users\Public\srtherhaeth.eXe
MD5
984287b2d5eb06be3bb771f84e3b5ee8

SHA1
c75b5e359169084504a78259fd79f0d1e86a19ef

SHA256
c28abaaad1b7b2c7a37f28e974e8214f07c88feffef986e0a60a44ab0fa575aa

SHA512
412af5359691a2caea5a4e452b9ed2603d31db6306cf1c0b375c5f67400769108bc89c047b080d96e8f647b6fb6a47bfe9d6c6a123a4f27839953cd624e7ff9a

Download Submit
\Users\Public\srtherhaeth.eXe
MD5
984287b2d5eb06be3bb771f84e3b5ee8

SHA1
c75b5e359169084504a78259fd79f0d1e86a19ef

SHA256
c28abaaad1b7b2c7a37f28e974e8214f07c88feffef986e0a60a44ab0fa575aa

SHA512
412af5359691a2caea5a4e452b9ed2603d31db6306cf1c0b375c5f67400769108bc89c047b080d96e8f647b6fb6a47bfe9d6c6a123a4f27839953cd624e7ff9a

Download Submit
\Users\Public\srtherhaeth.eXe
MD5
984287b2d5eb06be3bb771f84e3b5ee8

SHA1
c75b5e359169084504a78259fd79f0d1e86a19ef

SHA256
c28abaaad1b7b2c7a37f28e974e8214f07c88feffef986e0a60a44ab0fa575aa

SHA512
412af5359691a2caea5a4e452b9ed2603d31db6306cf1c0b375c5f67400769108bc89c047b080d96e8f647b6fb6a47bfe9d6c6a123a4f27839953cd624e7ff9a

Download Submit
\Users\Public\srtherhaeth.eXe
MD5
984287b2d5eb06be3bb771f84e3b5ee8

SHA1
c75b5e359169084504a78259fd79f0d1e86a19ef

SHA256
c28abaaad1b7b2c7a37f28e974e8214f07c88feffef986e0a60a44ab0fa575aa

SHA512
412af5359691a2caea5a4e452b9ed2603d31db6306cf1c0b375c5f67400769108bc89c047b080d96e8f647b6fb6a47bfe9d6c6a123a4f27839953cd624e7ff9a

Download Submit
memory/316-67-0x0000000000000000-mapping.dmp

Download
memory/316-76-0x00000000001F0000-0x0000000000250000-memory.dmp

Filesize
384KB

Download
memory/1344-66-0x0000000002200000-0x0000000002366000-memory.dmp

Filesize
1.4MB

Download
memory/1344-65-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1344-63-0x0000000000000000-mapping.dmp

Download
memory/1956-59-0x0000000000000000-mapping.dmp

Download
memory/1956-60-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download