30e923428a8f7f016603356c08387cd5b804633100cc3e91a7e40bbfef39ee26 | Triage

Analysis

max time kernel
142s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2022 08:20

Sharing

Report Analysis Logs

General

Target

rust.exe
Size

4.2MB
MD5

795a4fe7d2d6fa7adf455b832d53586a
SHA1

6ab69623b124747517b42124079b7e910c311c08
SHA256

30e923428a8f7f016603356c08387cd5b804633100cc3e91a7e40bbfef39ee26
SHA512

dade31801b2d52feba11ea8c60c2394809463c468b76dcc9f02d9e75383e94239fe653ef8502b23bfb8fc8e6223b3f0941b57f456824c6e22af8089d9bde1a81
SSDEEP

49152:D2p648E/EGyjlcm3+d7XFXFm5OiLgYrAvCT9GbUC+Z+XMvo6BCYqDM2wfNwOTZoI:qpJ0U1sDxkmdp4

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
15	ip-api.com

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

rust.exe

pid	Process
1672	rust.exe
1672	rust.exe
1672	rust.exe
1672	rust.exe
1672	rust.exe
1672	rust.exe

C:\Users\Admin\AppData\Local\Temp\rust.exe
"C:\Users\Admin\AppData\Local\Temp\rust.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads