Resubmissions
21-01-2023 02:04
230121-chntraad33 1019-01-2023 02:52
230119-dc3w6add69 1001-01-2023 05:14
230101-fxb1aabb96 10Analysis
-
max time kernel
64s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21-01-2023 02:04
Static task
static1
Behavioral task
behavioral1
Sample
RustExternal_nls..scr
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
RustExternal_nls..scr
Resource
win10v2004-20221111-en
General
-
Target
RustExternal_nls..scr
-
Size
658KB
-
MD5
556084cf64aec63e0babdf10a61afaa6
-
SHA1
b7fa21295db0657d1767c05bb440b218cecdf521
-
SHA256
d016fcbdb988d56df4c26d75a12e87a61010ed2366b52eefb8b409a1d8bcbaab
-
SHA512
6c896594ea47228f71f1dea7d9fd9f9842b5f178748a39c785ded34fb9dfd574c9bd781f1f65176e436453257078255803d729b79d823c01c6629fddfb3ce33e
-
SSDEEP
12288:LC/74rdbHgVBnqvFprkrUolVATWZXYm7ljg9hG80NEKXo1Y1UHC+O:LC/UGTWrkrUovUKfhkQNEwUnO
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
HJDS32.EXEpid process 1872 HJDS32.EXE -
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\HJDS32.EXE upx \Users\Admin\AppData\Roaming\HJDS32.EXE upx C:\Users\Admin\AppData\Roaming\HJDS32.EXE upx behavioral1/memory/1872-77-0x000000013FC40000-0x000000013FD9F000-memory.dmp upx \Users\Admin\AppData\Roaming\HJDS32.EXE upx \Users\Admin\AppData\Roaming\HJDS32.EXE upx \Users\Admin\AppData\Roaming\HJDS32.EXE upx \Users\Admin\AppData\Roaming\HJDS32.EXE upx behavioral1/memory/1872-83-0x000000013FC40000-0x000000013FD9F000-memory.dmp upx -
Loads dropped DLL 6 IoCs
Processes:
RegAsm.exeWerFault.exepid process 936 RegAsm.exe 936 RegAsm.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe 1472 WerFault.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RustExternal_nls..scrdescription pid process target process PID 1508 set thread context of 936 1508 RustExternal_nls..scr RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1472 1872 WerFault.exe HJDS32.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
RustExternal_nls..scrRegAsm.exeHJDS32.EXEdescription pid process target process PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 1508 wrote to memory of 936 1508 RustExternal_nls..scr RegAsm.exe PID 936 wrote to memory of 1872 936 RegAsm.exe HJDS32.EXE PID 936 wrote to memory of 1872 936 RegAsm.exe HJDS32.EXE PID 936 wrote to memory of 1872 936 RegAsm.exe HJDS32.EXE PID 936 wrote to memory of 1872 936 RegAsm.exe HJDS32.EXE PID 1872 wrote to memory of 1472 1872 HJDS32.EXE WerFault.exe PID 1872 wrote to memory of 1472 1872 HJDS32.EXE WerFault.exe PID 1872 wrote to memory of 1472 1872 HJDS32.EXE WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RustExternal_nls..scr"C:\Users\Admin\AppData\Local\Temp\RustExternal_nls..scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\HJDS32.EXE"C:\Users\Admin\AppData\Roaming\HJDS32.EXE"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1872 -s 2804⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
\Users\Admin\AppData\Roaming\HJDS32.EXEFilesize
532KB
MD589d77a6e1e3a08f6cbb5b440c8f47e29
SHA1b9f2db35241435b4ceed98b58b63918a6f4ce2e2
SHA2569f6badc3fdae2eec00ce41e5c07ccaef97eb9805d13328a1589e36fd1890181c
SHA512c6102fd3cc8438292a222583f40358e2039fab534765ed2f07e056df36c8f609ef51b55c782baaeeb1d2124b3aed5ebfbb9875dc136e560220a8339393c594e2
-
memory/936-70-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/936-61-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/936-67-0x0000000000403248-mapping.dmp
-
memory/936-57-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/936-64-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/936-62-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/936-59-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/936-66-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/936-76-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/936-56-0x0000000000400000-0x0000000000497000-memory.dmpFilesize
604KB
-
memory/1472-78-0x0000000000000000-mapping.dmp
-
memory/1508-54-0x0000000001050000-0x00000000010FA000-memory.dmpFilesize
680KB
-
memory/1508-55-0x00000000757E1000-0x00000000757E3000-memory.dmpFilesize
8KB
-
memory/1872-77-0x000000013FC40000-0x000000013FD9F000-memory.dmpFilesize
1.4MB
-
memory/1872-74-0x0000000000000000-mapping.dmp
-
memory/1872-83-0x000000013FC40000-0x000000013FD9F000-memory.dmpFilesize
1.4MB