Overview

overview

8

Static

static

1

RustDevblo...in.zip

windows10-2004-x64

1

RustDevblo...in.zip

windows11-ltsc_2024-x64

1

RustDevblo...ibutes

windows10-2004-x64

3

RustDevblo...ibutes

windows11-ltsc_2024-x64

3

RustDevblo...ignore

windows10-2004-x64

3

RustDevblo...ignore

windows11-ltsc_2024-x64

3

RustDevblo...st.txt

windows10-2004-x64

1

RustDevblo...st.txt

windows11-ltsc_2024-x64

8

RustDevblo...DME.md

windows10-2004-x64

3

RustDevblo...DME.md

windows11-ltsc_2024-x64

3

RustDevblo...DD.bat

windows10-2004-x64

8

RustDevblo...DD.bat

windows11-ltsc_2024-x64

8

RustDevblo...SD.bat

windows10-2004-x64

8

RustDevblo...SD.bat

windows11-ltsc_2024-x64

8

RustDevblo...le.ps1

windows10-2004-x64

8

RustDevblo...le.ps1

windows11-ltsc_2024-x64

8

RustDevblo...es.exe

windows10-2004-x64

3

RustDevblo...es.exe

windows11-ltsc_2024-x64

6

RustDevblo...t.json

windows10-2004-x64

3

RustDevblo...t.json

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    899s
  • max time network
    557s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 13:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    RustDevblogCheatChecker-main/Run-SSD.bat
  • Size 162B
  • Sample261102-qlzbjsfc27
  • SHA256 1be9b53ef7e841b7e81da049b3608782b90260b742c81157368d8eb7fd006c18
  • MD5 SHA1 SHA512 TLSH
Score
8/10
adwareexecutionpersistenceransomwarespyware

Malware Config

Signatures

  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 25 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Run-SSD.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Find-File.ps1"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\trz4xjp1\trz4xjp1.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:360
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6112.tmp" "c:\Users\Admin\AppData\Local\Temp\trz4xjp1\CSC2317EE23E69C4F25B796648AD8AA7E37.TMP"
          4⤵
            PID:2864
        • C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
          "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-everything-version
          3⤵
            PID:5124
          • C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe
            "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe" -startup
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:5616
          • C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
            "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-everything-version
            3⤵
              PID:1032
            • C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
              "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
              3⤵
                PID:5760
              • C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
                "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
                3⤵
                  PID:4244
                • C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
                  "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
                  3⤵
                    PID:2580
                  • C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
                    "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
                    3⤵
                      PID:1364
                    • C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
                      "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" -get-result-count file:
                      3⤵
                        PID:1076
                      • C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe
                        "C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\es.exe" file:<size:40|size:280|size:478|size:556|size:734|size:929|size:1001|size:1536|size:1897|size:1902|size:3130|size:3270|size:3556|size:3584|size:4027|size:4565|size:5414|size:5632|size:6052|size:6240|size:6649|size:6660|size:12729|size:12936|size:13081|size:13283|size:14632|size:14711|size:15360|size:15432|size:18432|size:18659|size:19432|size:22528|size:25434|size:27648|size:27930|size:28928|size:31583|size:34217|size:34304|size:34816|size:36307|size:37376|size:38360|size:42456|size:45016|size:48128|size:49624|size:59392|size:62464|size:62976|size:67019|size:68608|size:75264|size:77312|size:87552|size:91136|size:103936|size:104960|size:112336|size:114800|size:116224|size:122368|size:130560|size:132096|size:139912|size:141824|size:142336|size:145192|size:151664|size:154112|size:164352|size:166912|size:167424|size:169648|size:178176|size:185344|size:186368|size:187392|size:190464|size:202240|size:206336|size:226827|size:231045|size:233640|size:235008|size:271080|size:292864|size:307712|size:340480|size:343040|size:349696|size:395776|size:406976|size:418872|size:421584|size:422872|size:425472|size:438784|size:443904|size:458011|size:466544|size:489472|size:500050|size:529920|size:531968|size:532992|size:535512|size:538112|size:541184|size:551936|size:555520|size:559104|size:564736|size:568183|size:581120|size:616448|size:623104|size:629760|size:633856|size:644096|size:646134|size:651776|size:656384|size:711539|size:733905|size:735168|size:741384|size:754688|size:790368|size:795648|size:808448|size:843776|size:870400|size:913339|size:921088|size:978432|size:991888|size:1028096|size:1070592|size:1091584|size:1092608|size:1108992|size:1180160|size:1301159|size:1319424|size:1413120|size:1499136|size:1515520|size:1517568|size:1554432|size:1589143|size:1656832|size:1773056|size:1814016|size:1831936|size:1938944|size:1956797|size:1959424|size:1968128|size:1969152|size:2065408|size:2171392|size:2286439|size:2305536|size:2345984|size:2685952|size:2810880|size:2956288|size:3025920|size:3060736|size:3083776|size:3102208|size:3115008|size:3131904|size:3369584|size:3456000|size:3587584|size:3679232|size:3798016|size:4051968|size:4063744|size:4159512|size:4487168|size:4518400|size:4559214|size:4763648|size:5347164|size:6645248|size:7183978|size:7384576|size:8603054|size:9853176|size:17778738|size:18446935|size:21806272|size:23287638|size:23817775|size:24816079|size:28111360|size:35636224|size:37271552|size:61257728|size:65035264|size:74311003|size:177803506|size:266191481> -export-csv C:\Users\Admin\AppData\Local\Temp\everything-candidates-c2f2c9657d6e43fa9cde47a583eaa2e5.csv -no-header -full-path-and-name -size -size-format 1
                        3⤵
                          PID:3444
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:3984
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:5020
                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                      1⤵
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:5440
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:4308
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k GPSvcGroup
                      1⤵
                        PID:5252
                      • C:\Windows\System32\SecurityHealthHost.exe
                        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                        1⤵
                          PID:4448

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              prep_Activatable Class_Hermes_perf.cache
                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                              • Size 599B
                              • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              RES6112.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\RES6112.tmp
                              • Size 1KB
                              • SHA256 9c919fab19fa850f765b107e3f563197db5d66b81d35f10a9fd205f8ff2b406d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Everything.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\RustDevblogCheatChecker-main\Utils\Everything.exe
                              • Size 2.2MB
                              • SHA256 f191f756996a14a11e5445fa7103d302efd510cf2fbf920e6c0c8ed51d512e36
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              everything-candidates-c2f2c9657d6e43fa9cde47a583eaa2e5.csv
                              • Path C:\Users\Admin\AppData\Local\Temp\everything-candidates-c2f2c9657d6e43fa9cde47a583eaa2e5.csv
                              • Size 588KB
                              • SHA256 8a9d2b540d18c63946802df7439d5e78fd2c9be22139c6f7bf1acbda75dde54e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              trz4xjp1.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\trz4xjp1\trz4xjp1.dll
                              • Size 10KB
                              • SHA256 3d2795983f2da7b5c77cb80bc8d8b1449acac356ea0e1c552b2068ceb8eb9e81
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CSC2317EE23E69C4F25B796648AD8AA7E37.TMP
                              • Path \??\c:\Users\Admin\AppData\Local\Temp\trz4xjp1\CSC2317EE23E69C4F25B796648AD8AA7E37.TMP
                              • Size 652B
                              • SHA256 9b2e3769d3c89685b1409f9312f340fc68e385a5f30fd990ad3b5c19780312d1
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              trz4xjp1.0.cs
                              • Path \??\c:\Users\Admin\AppData\Local\Temp\trz4xjp1\trz4xjp1.0.cs
                              • Size 11KB
                              • SHA256 b2c4ab171baaf29e36ef3ed59027a68437a9b1b74c803a46c7717e3c3985ee0e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              trz4xjp1.cmdline
                              • Path \??\c:\Users\Admin\AppData\Local\Temp\trz4xjp1\trz4xjp1.cmdline
                              • Size 455B
                              • SHA256 a850bf997eca42a5feee04ed20aa6015404f51854d8972a2fdeb4f5d4aac6406
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              memory/3396-27-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-33-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-22-0x0000022AC2160000-0x0000022AC216A000-memory.dmp
                              Download

                              memory/3396-8-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-7-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-6-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-23-0x0000022ADAD50000-0x0000022ADAF12000-memory.dmp
                              Download

                              memory/3396-24-0x0000022ADB450000-0x0000022ADB978000-memory.dmp
                              Download

                              memory/3396-25-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-26-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-0-0x00007FFAFC8DF000-0x00007FFAFC8E0000-memory.dmp
                              Download

                              memory/3396-28-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-29-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-30-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-32-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-12-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-34-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-35-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-37-0x0000022ADABD0000-0x0000022ADABDA000-memory.dmp
                              Download

                              memory/3396-38-0x0000022ADAC00000-0x0000022ADAC12000-memory.dmp
                              Download

                              memory/3396-5-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-4-0x00007FFAFC750000-0x00007FFAFD0F4000-memory.dmp
                              Download

                              memory/3396-3-0x0000022ADA7E0000-0x0000022ADA802000-memory.dmp
                              Download

                              memory/4308-249-0x00000177363C0000-0x0000017736A51000-memory.dmp
                              Download

                              memory/5440-71-0x0000024A83D00000-0x0000024A83D20000-memory.dmp
                              Download

                              memory/5440-63-0x0000024A83EC0000-0x0000024A83FC0000-memory.dmp
                              Download

                              memory/5440-58-0x0000024A801E0000-0x0000024A802E0000-memory.dmp
                              Download

                              memory/5440-56-0x0000024A801E0000-0x0000024A802E0000-memory.dmp
                              Download

                              memory/5440-57-0x0000024A801E0000-0x0000024A802E0000-memory.dmp
                              Download

                              memory/5440-62-0x0000024A83A30000-0x0000024A83A50000-memory.dmp
                              Download

                              memory/5440-102-0x0000024A94280000-0x0000024A942A0000-memory.dmp
                              Download