2d4f1fcf5a961b59531482b549170ba557bf65ae06fecc2eee6f3a14a9bf6377

Analysis

user interaction
yes
max time kernel
116s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rustcheat.exe
Size 118KB
Sample260528-nd3ynafs2v
SHA256 2d4f1fcf5a961b59531482b549170ba557bf65ae06fecc2eee6f3a14a9bf6377
MD5 dffa235731c69c66e4e3438da8be5726
SHA1 dd29ae4bc7320bdf2b7ece14b81b85e2442c369a
SHA512 e5a0ff46387d2a2f8a42b671e060a53b6022f0f4cc47888e600b78de5ab92d3fae8ff0096693e26ce340b7ef98997cb8de7efc8fa49d99cc14af361b0b9791ca
SSDEEP 3072:GguHN8CPdC0LoZ7NeWPfJNXLQixhCH0Bscz:Ggu6sd4Z7Nn3JNXMi3U0Bs
TLSH
T1E3C35B17FA2910BED26B85F8C6574E02DB72BC55076167CB67D08ED20E17AE89F3E600
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsThemeService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\Media\\Backgrounds\\svchost.exe"	rustcheat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5344	rustcheat.exe

C:\Users\Admin\AppData\Local\Temp\rustcheat.exe
"C:\Users\Admin\AppData\Local\Temp\rustcheat.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:5344

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads