3833365c10aa47c6131a27f04e2d55be58a597e849145eaea9e6d01350181dfb

Analysis

user interaction
yes
max time kernel
25s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rust.exe
Size 77KB
Sample260807-c5e55awdkf
SHA256 3833365c10aa47c6131a27f04e2d55be58a597e849145eaea9e6d01350181dfb
MD5 e2f45301c32d98b01c2cf64f47f386e4
SHA1 ee7b8d49eeefdea0fa3730c372c443eefc46d43c
SHA512 d88b5f27d1e72a6ebcca64d2c9d079b1de47f3a44d897c22d16c121d0e667168ee9a77b618cec637d75c387ca34aa9331ccc79319c0f5e9f8a4281f5d9a2c983
SSDEEP 1536:GAo8V4a+cc3zNDllZPxjqi/bzMgicjTzoEw7:GAoI9+3zNDLZPxGibAgiInoEM
TLSH
T12873380ADD1670F7D2098DB4C5824A01EF72BC9A8B9177DB779C0CD91F946A89F3E206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3592	GameBarPresenceWriter.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{4BB691A3-76EB-40FC-9A33-1F693CF47BAE}	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3988	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\Rust.exe
"C:\Users\Admin\AppData\Local\Temp\Rust.exe"
1⤵
PID:4192

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:3592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads