Analysis
-
max time kernel
100s -
max time network
103s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30/04/2023, 22:20
Static task
static1
Behavioral task
behavioral1
Sample
Rust Hack.exe
Resource
win7-20230220-en
4 signatures
150 seconds
General
-
Target
Rust Hack.exe
-
Size
381KB
-
MD5
27fbef62df3372daedb9e41787c2d709
-
SHA1
0d62437eebf5d8a3ecb56bb159511399d5f1731d
-
SHA256
5cdd0a29b95fbd0317a39f8d1f3cc4465731e60a6e4dae8c2362a28e05ffc251
-
SHA512
ee72f805589625db624011b581ac5f2ec33f1d201ef6fd10c735755666d67d4a5dcf9d22739cf953503a8493c5523cd87286c248982caafd725a7575c1d37316
-
SSDEEP
6144:5VPYJFyH5kVp61/f1VRnHte0lr9iNbIrkzQrGmccby3x/MVWhCfl8UMM5/kxxgox:5VPY7yHcU1LFteyWbIrkErnbWh/bIfyF
Malware Config
Signatures
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1196 set thread context of 1940 1196 Rust Hack.exe 29 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1196 wrote to memory of 1940 1196 Rust Hack.exe 29 PID 1196 wrote to memory of 1940 1196 Rust Hack.exe 29 PID 1196 wrote to memory of 1940 1196 Rust Hack.exe 29 PID 1196 wrote to memory of 1940 1196 Rust Hack.exe 29 PID 1196 wrote to memory of 1940 1196 Rust Hack.exe 29 PID 1196 wrote to memory of 1940 1196 Rust Hack.exe 29 PID 1196 wrote to memory of 1940 1196 Rust Hack.exe 29 PID 1196 wrote to memory of 1940 1196 Rust Hack.exe 29 PID 1196 wrote to memory of 1940 1196 Rust Hack.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rust Hack.exe"C:\Users\Admin\AppData\Local\Temp\Rust Hack.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵PID:1940
-