rust-logger[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
rust-logger.exe
Size 8.3MB
Sample260924-nc84aacc46
SHA256 724063413e9a17676c20aa210bc9dfc46b70417903c36c588758f49ef818bb6e
MD5 825ddd5224d420ffb86cb29ffd8dc252
SHA1 864fd73fb5e6c87721acd0d0dceb3bba9359fe82
SHA512 eb1af0e0ec58b58cb01bfc8414198cb0b63c6cc439464f0d364364b11df643c7c2e867ea3c734513cdbcfd951e6b3b312f657aee7e2747989a83be65536f6853
SSDEEP 98304:5SPJMLc0M8WU96tANsBjCysfQ75+bwYVbY:sPJFY12n75y
TLSH
T13E964A12BA5B98ACD19AC474830646639E3174DB0B35BAFF41C496393F6ABF11F39318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rust-logger.exe

File Explorer

rust-logger.exe

.exe 8.3MB

rust-logger.exe

IMPHASH 1bca9070ed28155d2e35d5c89c433ecf
SHA256 724063413e9a17676c20aa210bc9dfc46b70417903c36c588758f49ef818bb6e
MD5 825ddd5224d420ffb86cb29ffd8dc252
SHA1 864fd73fb5e6c87721acd0d0dceb3bba9359fe82
SHA512 eb1af0e0ec58b58cb01bfc8414198cb0b63c6cc439464f0d364364b11df643c7c2e867ea3c734513cdbcfd951e6b3b312f657aee7e2747989a83be65536f6853
SSDEEP 98304:5SPJMLc0M8WU96tANsBjCysfQ75+bwYVbY:sPJFY12n75y
TLSH
T13E964A12BA5B98ACD19AC474830646639E3174DB0B35BAFF41C496393F6ABF11F39318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6083964

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rust_logger.pdb

crypt32

CryptUnprotectData

kernel32

GetProcessHeap HeapFree FindClose CloseHandle FindNextFileW GetLastError HeapReAlloc GetSystemTimePreciseAsFileTime GetTimeZoneInformationForYear GetStdHandle GetConsoleMode WideCharToMultiByte GetFileInformationByHandleEx lstrlenW GetComputerNameExW SwitchToThread GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes SetLastError GetFinalPathNameByHandleW GetSystemInfo CreateThread PostQueuedCompletionStatus GetConsoleWindow SetFileInformationByHandle DeleteFileW GetCommandLineW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread LocalFree SetFilePointerEx GlobalMemoryStatusEx K32GetPerformanceInfo GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind GetModuleHandleW FormatMessageW GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW FlsAlloc GetModuleHandleExW FlsFree FlsSetValue HeapAlloc IsThreadAFiber GetEnvironmentVariableW SleepEx ReadFileEx WriteFileEx QueryPerformanceFrequency QueryPerformanceCounter SetHandleInformation GetModuleHandleA GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW GetFileInformationByHandle ReadConsoleW CreateDirectoryW ExitProcess CreateEventW CancelIo GetOverlappedResult ReadFile CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess GetTempPathW CopyFileExW GetProcessTimes GetSystemTimes GetProcessIoCounters ReadProcessMemory VirtualQueryEx OpenProcess SetConsoleMode SetConsoleTextAttribute GetConsoleScreenBufferInfo SetUnhandledExceptionFilter InitializeSListHead CreateMutexW GetTempPathA MapViewOfFile CreateFileMappingW FormatMessageA GetFileSize HeapDestroy HeapCompact LoadLibraryW FlushViewOfFile UnlockFileEx HeapSize HeapValidate GetFileAttributesA OutputDebugStringA HeapCreate InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetFileAttributesExW CreateFileA SetEndOfFile DeleteFileA UnlockFile Sleep LockFileEx FreeLibrary UnmapViewOfFile GetDiskFreeSpaceA GetSystemTimeAsFileTime GetSystemTime GetTickCount FlushFileBuffers GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW WriteFile AreFileApisANSI OutputDebugStringW SystemTimeToFileTime

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

getaddrinfo WSACleanup send freeaddrinfo ioctlsocket getsockopt connect WSASend recv WSAStartup WSASocketW shutdown getsockname WSAGetLastError getpeername closesocket bind WSAIoctl setsockopt

ntdll

NtDeviceIoControlFile NtCreateFile NtOpenFile NtWriteFile NtReadFile RtlNtStatusToDosError NtCreateNamedPipeFile RtlGetVersion NtCancelIoFileEx NtQuerySystemInformation NtQueryInformationProcess

advapi32

SystemFunction036 RegQueryValueExW RegCloseKey RegOpenKeyExW CopySid GetLengthSid IsValidSid GetTokenInformation OpenProcessToken

bcryptprimitives

ProcessPrng

shell32

CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

bcrypt

BCryptGenRandom

user32

ShowWindow

oleaut32

GetErrorInfo

iphlpapi

GetIfTable2 FreeMibTable GetAdaptersAddresses

pdh

PdhOpenQueryA PdhCollectQueryData PdhRemoveCounter PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCloseQuery

psapi

GetModuleFileNameExW

powrprof

CallNtPowerInformation

vcruntime140

memcpy memmove memset __current_exception_context __current_exception __C_specific_handler _CxxThrowException memcmp strrchr __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

wcslen strlen strcmp strcspn strncmp

api-ms-win-crt-heap-l1-1-0

free realloc _msize _set_new_mode malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr pow log

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

__p___argv exit __p___argc terminate _endthreadex _c_exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _initterm_e _register_thread_local_exe_atexit_callback _beginthreadex _exit _get_initial_narrow_environment _set_app_type _seh_filter_exe _initterm _cexit _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale