c6dda31fa6cb4ce140f62c9ce604672fa4a9ba5d1792f2d77f3cfcb43b3227ac

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/02/2023, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RustExternal_nls.exe
Size 658KB
Sample230214-tmg1faee72
SHA256 c6dda31fa6cb4ce140f62c9ce604672fa4a9ba5d1792f2d77f3cfcb43b3227ac
MD5 1ab8dbca5e2bba39723f00907d266de7
SHA1 729cb808637568f20ac886b3fac5f3cf5ff01dee
SHA512 d1a31848eb9b683793afd36031ef8078ff962c2526272782cf2fca8db11afb71643a46b9ad6bce3ba8dba1b638672205726f6e96c7dd3e887228a2368ec08081
SSDEEP 12288:3oSO5i2eVUIvybKcEz4MM7S9HdKINesX7j6p9PI8GS0oN2:3ouTVUIvtH4H7aLeO23gRoY
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1752	DEFENDERFILESECURITY.EXE

Loads dropped DLL 6 IoCs

pid	Process
1352	RegAsm.exe
1352	RegAsm.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe
1956	WerFault.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000005c50-73.dat	upx
behavioral1/files/0x0007000000005c50-74.dat	upx
behavioral1/files/0x0007000000005c50-76.dat	upx
behavioral1/memory/1752-78-0x000000013F920000-0x000000013FA7F000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-80.dat	upx
behavioral1/files/0x0007000000005c50-81.dat	upx
behavioral1/files/0x0007000000005c50-82.dat	upx
behavioral1/files/0x0007000000005c50-83.dat	upx
behavioral1/memory/1752-84-0x000000013F920000-0x000000013FA7F000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 1352	1096	RustExternal_nls.exe	26

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	1752	WerFault.exe	27

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1096 wrote to memory of 1352	1096	RustExternal_nls.exe	26
PID 1352 wrote to memory of 1752	1352	RegAsm.exe	27
PID 1352 wrote to memory of 1752	1352	RegAsm.exe	27
PID 1352 wrote to memory of 1752	1352	RegAsm.exe	27
PID 1352 wrote to memory of 1752	1352	RegAsm.exe	27
PID 1752 wrote to memory of 1956	1752	DEFENDERFILESECURITY.EXE	28
PID 1752 wrote to memory of 1956	1752	DEFENDERFILESECURITY.EXE	28
PID 1752 wrote to memory of 1956	1752	DEFENDERFILESECURITY.EXE	28

C:\Users\Admin\AppData\Local\Temp\RustExternal_nls.exe
"C:\Users\Admin\AppData\Local\Temp\RustExternal_nls.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #cmd
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Users\Admin\AppData\Roaming\DEFENDERFILESECURITY.EXE
    "C:\Users\Admin\AppData\Roaming\DEFENDERFILESECURITY.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1752 -s 284
      4⤵
      Loads dropped DLL
      Program crash
      PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DEFENDERFILESECURITY.EXE

Path C:\Users\Admin\AppData\Roaming\DEFENDERFILESECURITY.EXE
Size 532KB
SHA256 69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c
MD5 84e6aa267c6970d2d777d60840390102
SHA1 c97e555e98c5bec69bcad9607cf0153ff827a141
SHA512 47184ca58f7358bad24acbcfc2038a510a1ae55b90b927d79a98df13c0e911daeaadb1100f0dc112370fe61bf6264fb9ff214d143d17af659e0bd1ba16f0cecc
SSDEEP 12288:Lflmc/U97143ei/xLxS0VMmX+gJmdqKkSl2N3m:LNtsCF/x9S0KaJuqnSl2N3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEFENDERFILESECURITY.EXE

Path \Users\Admin\AppData\Roaming\DEFENDERFILESECURITY.EXE
Size 532KB
SHA256 69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c
MD5 84e6aa267c6970d2d777d60840390102
SHA1 c97e555e98c5bec69bcad9607cf0153ff827a141
SHA512 47184ca58f7358bad24acbcfc2038a510a1ae55b90b927d79a98df13c0e911daeaadb1100f0dc112370fe61bf6264fb9ff214d143d17af659e0bd1ba16f0cecc
SSDEEP 12288:Lflmc/U97143ei/xLxS0VMmX+gJmdqKkSl2N3m:LNtsCF/x9S0KaJuqnSl2N3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEFENDERFILESECURITY.EXE

Path \Users\Admin\AppData\Roaming\DEFENDERFILESECURITY.EXE
Size 532KB
SHA256 69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c
MD5 84e6aa267c6970d2d777d60840390102
SHA1 c97e555e98c5bec69bcad9607cf0153ff827a141
SHA512 47184ca58f7358bad24acbcfc2038a510a1ae55b90b927d79a98df13c0e911daeaadb1100f0dc112370fe61bf6264fb9ff214d143d17af659e0bd1ba16f0cecc
SSDEEP 12288:Lflmc/U97143ei/xLxS0VMmX+gJmdqKkSl2N3m:LNtsCF/x9S0KaJuqnSl2N3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEFENDERFILESECURITY.EXE

Path \Users\Admin\AppData\Roaming\DEFENDERFILESECURITY.EXE
Size 532KB
SHA256 69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c
MD5 84e6aa267c6970d2d777d60840390102
SHA1 c97e555e98c5bec69bcad9607cf0153ff827a141
SHA512 47184ca58f7358bad24acbcfc2038a510a1ae55b90b927d79a98df13c0e911daeaadb1100f0dc112370fe61bf6264fb9ff214d143d17af659e0bd1ba16f0cecc
SSDEEP 12288:Lflmc/U97143ei/xLxS0VMmX+gJmdqKkSl2N3m:LNtsCF/x9S0KaJuqnSl2N3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEFENDERFILESECURITY.EXE

Path \Users\Admin\AppData\Roaming\DEFENDERFILESECURITY.EXE
Size 532KB
SHA256 69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c
MD5 84e6aa267c6970d2d777d60840390102
SHA1 c97e555e98c5bec69bcad9607cf0153ff827a141
SHA512 47184ca58f7358bad24acbcfc2038a510a1ae55b90b927d79a98df13c0e911daeaadb1100f0dc112370fe61bf6264fb9ff214d143d17af659e0bd1ba16f0cecc
SSDEEP 12288:Lflmc/U97143ei/xLxS0VMmX+gJmdqKkSl2N3m:LNtsCF/x9S0KaJuqnSl2N3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEFENDERFILESECURITY.EXE

Path \Users\Admin\AppData\Roaming\DEFENDERFILESECURITY.EXE
Size 532KB
SHA256 69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c
MD5 84e6aa267c6970d2d777d60840390102
SHA1 c97e555e98c5bec69bcad9607cf0153ff827a141
SHA512 47184ca58f7358bad24acbcfc2038a510a1ae55b90b927d79a98df13c0e911daeaadb1100f0dc112370fe61bf6264fb9ff214d143d17af659e0bd1ba16f0cecc
SSDEEP 12288:Lflmc/U97143ei/xLxS0VMmX+gJmdqKkSl2N3m:LNtsCF/x9S0KaJuqnSl2N3
MD5 SHA1 SHA512 SSDEEP

Submit Download

DEFENDERFILESECURITY.EXE

Path \Users\Admin\AppData\Roaming\DEFENDERFILESECURITY.EXE
Size 532KB
SHA256 69f7c84e27083e5af30a91c797c6c1d5b694c2926ebb8a9edb7c6ed8e4c3cb3c
MD5 84e6aa267c6970d2d777d60840390102
SHA1 c97e555e98c5bec69bcad9607cf0153ff827a141
SHA512 47184ca58f7358bad24acbcfc2038a510a1ae55b90b927d79a98df13c0e911daeaadb1100f0dc112370fe61bf6264fb9ff214d143d17af659e0bd1ba16f0cecc
SSDEEP 12288:Lflmc/U97143ei/xLxS0VMmX+gJmdqKkSl2N3m:LNtsCF/x9S0KaJuqnSl2N3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1096-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Download

memory/1096-54-0x00000000003A0000-0x000000000044A000-memory.dmp

Download

memory/1352-62-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1352-61-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1352-72-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1352-66-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1352-56-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1352-64-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1352-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1352-57-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1352-59-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1352-70-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1752-78-0x000000013F920000-0x000000013FA7F000-memory.dmp

Download

memory/1752-84-0x000000013F920000-0x000000013FA7F000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads