Resubmissions
21-01-2023 02:04
230121-chntraad33 1019-01-2023 02:52
230119-dc3w6add69 1001-01-2023 05:14
230101-fxb1aabb96 10Analysis
-
max time kernel
43s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-01-2023 02:52
Static task
static1
Behavioral task
behavioral1
Sample
RustExternal_nls..scr
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
RustExternal_nls..scr
Resource
win10v2004-20221111-en
General
-
Target
RustExternal_nls..scr
-
Size
658KB
-
MD5
556084cf64aec63e0babdf10a61afaa6
-
SHA1
b7fa21295db0657d1767c05bb440b218cecdf521
-
SHA256
d016fcbdb988d56df4c26d75a12e87a61010ed2366b52eefb8b409a1d8bcbaab
-
SHA512
6c896594ea47228f71f1dea7d9fd9f9842b5f178748a39c785ded34fb9dfd574c9bd781f1f65176e436453257078255803d729b79d823c01c6629fddfb3ce33e
-
SSDEEP
12288:LC/74rdbHgVBnqvFprkrUolVATWZXYm7ljg9hG80NEKXo1Y1UHC+O:LC/UGTWrkrUovUKfhkQNEwUnO
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
HJDS32.EXEpid process 1760 HJDS32.EXE -
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\HJDS32.EXE upx \Users\Admin\AppData\Roaming\HJDS32.EXE upx C:\Users\Admin\AppData\Roaming\HJDS32.EXE upx behavioral1/memory/1760-77-0x000000013FE80000-0x000000013FFDF000-memory.dmp upx \Users\Admin\AppData\Roaming\HJDS32.EXE upx \Users\Admin\AppData\Roaming\HJDS32.EXE upx \Users\Admin\AppData\Roaming\HJDS32.EXE upx \Users\Admin\AppData\Roaming\HJDS32.EXE upx behavioral1/memory/1760-83-0x000000013FE80000-0x000000013FFDF000-memory.dmp upx -
Loads dropped DLL 6 IoCs
Processes:
RegAsm.exeWerFault.exepid process 2020 RegAsm.exe 2020 RegAsm.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe 1876 WerFault.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RustExternal_nls..scrdescription pid process target process PID 2004 set thread context of 2020 2004 RustExternal_nls..scr RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1876 1760 WerFault.exe HJDS32.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RustExternal_nls..scrpid process 2004 RustExternal_nls..scr 2004 RustExternal_nls..scr -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RustExternal_nls..scrdescription pid process Token: SeDebugPrivilege 2004 RustExternal_nls..scr -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
RustExternal_nls..scrRegAsm.exeHJDS32.EXEdescription pid process target process PID 2004 wrote to memory of 1968 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1968 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1968 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1968 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1968 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1968 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1968 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1992 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1992 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1992 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1992 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1992 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1992 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 1992 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2004 wrote to memory of 2020 2004 RustExternal_nls..scr RegAsm.exe PID 2020 wrote to memory of 1760 2020 RegAsm.exe HJDS32.EXE PID 2020 wrote to memory of 1760 2020 RegAsm.exe HJDS32.EXE PID 2020 wrote to memory of 1760 2020 RegAsm.exe HJDS32.EXE PID 2020 wrote to memory of 1760 2020 RegAsm.exe HJDS32.EXE PID 1760 wrote to memory of 1876 1760 HJDS32.EXE WerFault.exe PID 1760 wrote to memory of 1876 1760 HJDS32.EXE WerFault.exe PID 1760 wrote to memory of 1876 1760 HJDS32.EXE WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RustExternal_nls..scr"C:\Users\Admin\AppData\Local\Temp\RustExternal_nls..scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\HJDS32.EXE"C:\Users\Admin\AppData\Roaming\HJDS32.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1760 -s 2844⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
memory/1760-74-0x0000000000000000-mapping.dmp
-
memory/1760-77-0x000000013FE80000-0x000000013FFDF000-memory.dmpFilesize
1.4MB
-
memory/1760-83-0x000000013FE80000-0x000000013FFDF000-memory.dmpFilesize
1.4MB
-
memory/1876-78-0x0000000000000000-mapping.dmp
-
memory/2004-54-0x00000000001A0000-0x000000000024A000-memory.dmpFilesize
680KB
-
memory/2004-55-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB
-
memory/2020-70-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2020-67-0x0000000000403248-mapping.dmp
-
memory/2020-76-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2020-66-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2020-64-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2020-62-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2020-61-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2020-59-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2020-57-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/2020-56-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB