| File name: | Rust.exe |
| Full analysis: | https://app.any.run/tasks/6fe8cb47-bfe7-4824-b14c-61f088402eb9 |
| Verdict: | Malicious activity |
| Threats: | XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails. |
| Analysis date: | November 08, 2024, 15:44:20 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 191B838B8DDC7C8AA5CD9731D1C329B8 |
| SHA1: | 6067FCD793EFB9D5866557C83BE3E018130EB538 |
| SHA256: | 646AC6C8F86341DD6B9184568E6A18C1B7FB99EFBEAFB46C5D4CAEFF25246D80 |
| SSDEEP: | 1536:pxMNYQinaaSC4Z3Rn+qcUpbYp1lgd86G1YO9UgqG:7MBX3Rn+MpbYZgd01YO9Uo |
MALICIOUS
XWORM has been detected (YARA)
- Rust.exe (PID: 6024)
XWORM has been detected (SURICATA)
- Rust.exe (PID: 6024)
Connects to the CnC server
- Rust.exe (PID: 6024)
SUSPICIOUS
Executable content was dropped or overwritten
- Rust.exe (PID: 6024)
Connects to unusual port
- Rust.exe (PID: 6024)
Contacting a server suspected of hosting an CnC
- Rust.exe (PID: 6024)
INFO
Checks supported languages
- Rust.exe (PID: 6024)
Reads the machine GUID from the registry
- Rust.exe (PID: 6024)
Reads the computer name
- Rust.exe (PID: 6024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
XWorm
(PID) Process(6024) Rust.exe
C220.ip.gl.ply.gg:53788
Keys
AES123456789
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
Mutex0EoaRHqmP37rmlUb
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:09:10 17:00:35+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 11 |
| CodeSize: | 64512 |
| InitializedDataSize: | 2048 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x11b3e |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| FileDescription: | |
| FileVersion: | 1.0.0.0 |
| InternalName: | Rust.exe |
| LegalCopyright: | |
| OriginalFileName: | Rust.exe |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
133
Monitored processes
1
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6024 | "C:\Users\admin\AppData\Local\Temp\Rust.exe" | C:\Users\admin\AppData\Local\Temp\Rust.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Exit code: 0 Version: 1.0.0.0 Modules
XWorm(PID) Process(6024) Rust.exe C220.ip.gl.ply.gg:53788 Keys AES123456789 Options Splitter<Xwormmm> Sleep time3 USB drop nameXWorm V5.6 Mutex0EoaRHqmP37rmlUb | |||||||||||||||
Total events
899
Read events
897
Write events
2
Delete events
0
Modification events
| (PID) Process: | (6024) Rust.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | wusvcs |
Value: C:\Users\admin\AppData\Roaming\wusvcs.exe | |||
| (PID) Process: | (6024) Rust.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\3C54740F7CC0F23B53E5 |
| Operation: | write | Name: | CC52384910CEE944DDBCC575A8E0177BFA6B16E3032438B207797164D5C94B34 |
Value: 004A00001F8B0800000000000400ED7C0B785C55B5FF3A6766CE3933939964264D9AB64999D287D3260D4D5FB4D0D2E6D147A06943D3D207423A99394DA69DCC49CF4CA0A15227A2572A96BF28782DE8E575F5D27BD52BA250540444D4A2A8E85FE47AA182A817142FF8FAFE8A5AEF6FAD73E691A628F77EFFEF7EFFEFFBDF69B3CE5E6BEDBDF67AEDB5F73E99B667F7FBC843445EFCFCF9CF4427C8F9ACA5BFFE29E0277CCEE7C2F419FF93B34E289B9E9CB56D289D8B8DD8D6A09D188E2513D9AC958F0D98317B341B4B67635D5BFA62C356CA6C0D8502735C19BDEB8836291EFABB1FBE6416E53E4FE7C6824A2F510710CDA105F600C4DC49896AA4AD3A7A13959FF48843E78F87D6BE8BBBF2DFF2B3F490CF897EA22DAE311FF29CC5C83B88AADE842F267DA09F51811AC03756E0AD79F3609E7559EBF4155BD54922F6B4DA393B49AE6ED0510CED9AD80F22D6B6DA66C64ABABADEE1CADA38A95FC7996ABED2EF3C37CA101F6D5A46F499F9444AB1437F3927DECC67A61A9F8A682D98476ABC010D5AF0B1DC343C0B10E8CD4DE716472D37835B1E6E35720B567917D42E522436E81AA1C33CC06A0233D04C5A89A70A8F455833CFE47984C742AD73CEE47985C7D358B1324FA555E0F98407E89D129F0566506F996563FA916F83A6C6CF05C99A0D9043D206AA8C824FC4C980D21C419254851CAD483E97D402230B2ECB212A5A7C2E46E741500B3A53E1A979EC29A2E2785DC6EBC5F113E9F1106408FDFE29A7B53A20B9B7B04E71769FC1BA9FD6A64FA4FADD69E63BD3D00CD8BB83242F23AC46007C4F013378BD0548F7FA0AD0D31BF616C2781C6699D6020EE1617FA9796AC6DC7833BB8874AB05CFF842A6C65B014F11EBACC8E25268C54A9A019F2903F5856A8CAEDF578870B0CF63BD6A592FD147A78BE1673FEBD330B531B788B910E0AD73BA4F3DBA1A220AD109230F7387187D8DC86A13EDCAF862C61DC26136EE30DB165FC2F15BCAACA9A20B35C49156DABC532131A5A47D1CA91FB8311D882FE701E773ACA36A7C055B7B8EFF28168F32B7DE864D2377CD9D7A98FD75D7DC062DBE12FCBBE64E7309D3A34AFC02F68B439EE1921B41BEB04C6E72C9330FB3A7EF8AAF6256032790A33B1B5C2FF0C6743DE25ACF71852B02C2B62E426BDEA93A2712218A4FE391452BE058A59163B09F02A3149A2DCBE9627A798952C76DF6F9EF15F113724D42735A09682D9A23C5F59E6AAD9175507F5AAD3256F2DA3D1C91B09C5642FE950F7237D1F1260CAEF546BC2BDFCB248E8EB5966D99C3F9DECE11E3610EA38327AD086344D202E37D115FCB7237E26FDEFEE7967389122953F7FDE081A94F9773859AA738CAB84A5A9D622FADF80C15D57438BAD5251924FAAD63F92C0E2A6911AD65F0300A99B745974773FDE17A666917B12AEBD1756E81E9B90D68D6EA11BD6CBCB5916516ED399BE9532B553DD7B1A1ACC30F269943D4EC77A37CAAF33F9121F54E86D41A135244E114A1F646A75E4FC1CF93F0E40BF88110727244251410AE3D5C27E28D32B3BBF203A49D65E52F28AE7B5486198E0C1F7D80643F820CC7F8801A9FCD89810AA505F51BD3B21A6C081D8977B34466566946BD7163DA098CA6D7EBC5B6185637D5BA984D13441377D76BE2B507EAAD4BC4E82AD25A74CDDAC4639E7DE345C26B4445E531B3C5ED5DA1436FA3BAA2FD5F0125C4BA3BF5CB99DEEA2969626DAE2C8767778A9B585BCA39D6F1D76B283985B7B7B267151967EDE99FD43344FEB34507462D25D949A6C59CF81076BE69DB8BED03147E7BB17D1B858F97637812A3C2EC87159F472BB6681475F2D27299B5B6B2F5DACAEBA818E4A07D1E07B414E82AE3EC810EE9FE7A7F31B87A45D027075A7702AD4F0874BC4FECAE22BD45D7DD70139572DE7B46C4696AAD6FC5EA3FF311D78DFD02B28E15631FA10F1DA7FAA2CDDFC7F1A2DACDFD38DBC1E54C4A765D7D7C9B13EEFA5B837A7CB1D8177BA1EDA98796AD3162F76EEF3FBC6CBA11AB9E7E817AE17779D992436C3DB0C254F90C58F748F89317FEC4E5F0B00B3FC87569A330AB4E4E7F9287EF5CFFD413ADFB9B5DCA8577708F79D2E3C427BEF4BF5BAB99F3C3A77FF3A7D6B615D520EB36769691FAF87628B6F276EECCF55DB72F2D531F66EA8B424D96A93F62EA93423D54A63EC3D407847A5D99FA6BA6DE29D41BCA540D84153708F56FCBD4185347857A7B997A3E53FBB966C7CFE1F0FB0F5FC6A9B0438215F1B634F86375E04ECDEDE42A26BC99BC4B63D4FCD228DE2B2AC671999E16F1C9C0FAB30C7C8D63EBE4C18A1F735B9B7A6B7C177A680DCE33B79B91692E71BAF3E4B58301F7FDD501F1369E67C57B8A1D97B81DF999BB9C3BBC55AAD83487545F5F3F95CF971A35EF26EE7785EC1D3CF24A29D311A33EA22FF434342BF587FB79F8B92CBF7921D5C7F770077FC46FDF0B8FF288843BD700F79BCB499AE4B990FBA79ADC2510A048E0ACC5A058FBD9AD0F20834EE0A7C9ADFDB58B3C84C5C467669C3953BCA0EBAB50844346ADD70FF77B6BB5E6B7E811ED560BD7B580EA04974F01D803B110C108344728A24D7D9AA313F1B57D774AE9AC1D9195C672F7F2586B90DC8338F119D8E1472BF84315FC198BBCC417C45A675DE6D2ACD974D924AB503DA65BFBB82818F5F1FD5205F5FA5C4632CB3FF507EE5ECACA477CF57E6B987B467C8153D309796744BCC5EA515149644EA74EB4505337974067BFD8BCC3A919ACCF5B9DFD3352AC7C2A2A5D96CBB52824C58CF4A9A248C8AFD6836D594CF45B236EEDF2B7E87E7746A7C8052616346D81A3C31CAA5BE9CCABE2F4BE7E735907F890EA5887DC01562167CB76A11B87F9282F85D6CA8164E5A5CC3658A3F2B4AE629D54B827E2AD8FE00C615D2D93CF7453C74711DF5F3ADF87E8820DD4E4D4CBFFB20E07FFEFE980332DC9F925E29CE2D55BE5FC1E249CBBC7D0C0E31A3C6281D83CCA1D7276D4F8DB242E605DEBF4382C6BD4B0DE8EA761158AAB3D16A36F9035CE3A44BDDFAE2DDE08E3EF00B81687766FD41B5FE0D6A6967511EFA1697CC4730F914BFC16AA6800545C78BD87104C6FB1DDE4B4A7B38F9A79A1FBAD774ACAF00D2D706A61657238179589C6E4DEC5EE72DD5291AF8BE8D6278AFB5A98BEF634CD2AC6E94AAEAFEC236FBC852F939AF537ECABF8BBC5DDD07E2E696AEE7A8942831B050D6B397EA43200C56C3F8CBA17F0ECCBDDC0EEB43FCB9B7B8C0BFBD4DC7BDD9A6E1D658F1A77B967855ABD1E354E8F1AF11B455EE99A551B8806E49E55EB7764D706B548106961FD2FEE58BE7C1D9A78F98A049DDBC63C2E7FEFA389F730FFD9EF61FE37770F3B15A64810B521583C48862306503D7E9384E8593A55E33AA8AA7C7F941349E9AC359D8273A9817DAFD2DDF48EB98A5B43DE460F2E73DAB0869E5EAFD438F1F1108A0335707CA2CAE93A24B3AA22D46B3935F443313E071DC2C6E6FD41957E689660E7301632A63EED9FFAB464034E3D11AFE435875332AF5653235A03DFC570E185513E58E1738D8AB8EF19783DA9B48EEA763B758E736518B9324DD6F47F31D8BE7A2C005F549B146C030920C1D6DD60FBE3E77100DFCFCE5FC40B29807DAB22338388C45BB09739A9595BCECD2A8A549D999B9140C4FF2632C7FF1732473F7BE6E86F3E73FC70B2BF9C391AFB7C72E684CEC81C59C3ED292733AE77EE1F748B9313E4E41111B3BF859F250A919B44F2AA6F359F4140EBACA0F3A78DC782B64D71DE7B3A7B3C5709CE508AC41EFF48E378406D995B1F6C9EA2EA16EE6C012D11FB8042CAEE803E75675057AD9B413B4F6D7EA1B88F4739473837544FFC1636FC83E58D9ADF5971F169147EFC6FE98CF7704D4CFF764DB18A967855C5BD5F8D7F882ADECFF1B964A6D0DFEBC3AC534E2B41BDC588C39AE640B38F54E9388F3CA7EB982DAF1DE7BBCB50CE14D80DE81C197FE8564EC1DB389BF5F71A8EAC2AA3654A1CEE6B0E3A6CDDFAB053827591BBB5284DCD7D84AB3D7759D09A43B0B502BF0E58B0D893C71D6C06BFF284F11D7D177728EE9B53B6E7AAA5AD8B5A972C5AD2B692293EC241804EC0F4D9D869E6E0D4F00A2E19B3FBF2763A3B98E31E3558D6DFE0186DEFA36767B9F1DAB0BD9B5FF7BE02FC6B3AF08E8C35508EBBB2A3E9AE263FE4D0EBCA12DE0079F67E672FA4599C4FF8611F7CC43DEF7539FEE0779EFCDE4D8CF554B41597C74FDDE539AFA5BFAE3B966934CD97ACD2E86F04BEE63916ACA6C7F80527B57957FB35FAA3C0611FC39502B70A3C28F4266F13461DF330FCB2503EE01DD102F405CFEDB856253DB7EB01F27A6FD7C3B4D0F3EB60985E0F3C10D4E8E3DE63686FF4AEAA0AD31EEF4645A3F3C351234C5F0A709F1784F23B95294D340A09FFE0396668F45DE8A6D1610FEBF9AEC07580EFF1C7FD015AEDA9C5BCFB95359A466FF5478D000D853D618D7EA17F0739385FFBBA16A54FA85F07F70466D1E8D5F01A500EF97741CF1FE9DF00C5568E546BF4733FC376E34875944EF879D4FB820CBF1AD805F8E9D02E48F8AECA12DE21F01FAB5763F68D32FB1F21334CB3945555017A593B160CD07DD59E70807EA5327C4E657D3EE5638B0643ABAAEAE9FD4667081ED358CE253AEBFCFB2AEEF36BE81CA0B5D2FF2A99E543C4A36A431BB1C93CA130FC3224687424C85CA33A6A44E9E5F0D7B57A9A176499D70BFD7158BA464905388E0FA8DF01ECD5E6C1BA53019E6BAECA56B7186CEF3481CB54B6BA29CC96EE54D96AF2B3C786F5A6AA28D901B6BD2BC81EBE3BC4FE5F8859387BD29243C555F22B2353DD5DC27E17C854F7A0CD795D43178533D55700F34832FE5DD5CD555720330DE1C54399EA77213F83C2FB7E35F73450F7B8C6DC6FDC6F30562D52178418C3D949780361C6AA718B60DE77AA189BC2B50CE80301076B12DE937E079B2F586F356375D42A3D71BE25C616930FD84F820EB644B016977701F9B0FCFE5DB07A5A4501F0BECA7251CDD708769F608DC0788D6D909E335DDEE230F3665207EAF7C2409DB78DBC8126C086C05CC0F58185DE086D359601D6795602FE1FE5226F3DEA7907E0150267546F00AC11F83362F84581B7097C9F7231E08FA90770B9BE15F09AC076C0176997F7D2C2ED74A577162DAE3EE5594E9FA204E8B87B79353AEDBB123014623837F83DACB9B785F6A1BDAF9A292F093C1866F87D3FC3EBA57D8171A5B7372695A3E17CAC4785764EC006048B34AC0E3E0CECBD82D51A3F0F64BD0ADDE3623F3272C0BEEC625F0C1C04F6BC8B7D2F782DB03FBAD878E01DC0BA6639D89FD47703BBDCC5FC9EA3C052B3CAF3A974CDACB22E2ABD53B07AE3E3E19BBD2A7DD81D3723C4D87D13C6BD3061DC2BCE38DAEF3FE69DC8D369CFB9E571FA19BCB79DEB8CEB0D33EFB5D90EF692EF2EAF4E53E639584239EE3568A78B3DA27C0EB57ACA5B1CECC3CAC3C8EDC6B8835DA031563943806AE63BBCBD90E2DC2D0A541FFB66E89FBDC112B64FFD8CB7AA84ADAAFE82B7866A5A9C711FF43FE2AD29F19E0B7FD51B71B1DAD853E16F233786DC9E37E1F2309DAE77B1E769976706DDE362BF0B3DE36DA4150B1DEC55604DF40517DB177CC63B93D6B63AD82660E74CB021E6CE17897DD4FF436F197BCCF829B2F4CB322E42D71AFFEE9D4B2F9DE74899EBF9AD77DE0429F32BEC3BED9D4FD7B7393DFFD5AFFAE6D394C50EB65DF5FB16D06F9648DCE90F38C0B6D02239CD7F455D15FA846721F5BA588DAA29AD3424D875F433B5DED74AEF747927B4FB51293EBCD4D12CACCC00EF71C1147A9D66FBCEA36F2D2D6BB6889E15CC63FC9BB20558D3B24A5EA50D8B68F1B2722E2DA28B9639E382B45B99D8B3AD64EDFC70B3AF8C5D51BDC4B744F4F88E8FE1278977F767590A7D89F83DF71788F7FF130A735FF2335C2AED9F6815ED10C3CF2B3CF6058DC706F99D3579B938D3E322DF17626EBA9AB9F26B26CA8558B2253237E8CCBDD2602EF7F4BAF429E1F22CB1EAC95005ECD4B97DB368FE9268FE8A68FE90CCBE57E4B4F2AF59E99470AF14691F5327D28B73DD2FFD75B50C152A5B7785F4795CDA1F0DB3B45F55F9E9FCA082B8B29FA70106905BE7076BE073862B05B60BEC1678A9C05D80759490765AE001816380D3E908608CEE1499C705DE2BF02420F2587ABE2C945F0ABC49E031815502A7086C1438C7A5733E4D11D828708EC0076949683F3D4537AB07003F563D46BF47FFB7D3BDCA3F2947C9AFF0D807016FA308E09DE8CF9488A262D77F54A90BFE334D53AE54EFA793CA17D4CF81E2412ECE9751B300BF0DD8808BC82CC507F84BE596C073686F0FFF887EAFEC0CBD04F86EE355C08F077F4B2B95DFFAFE803E273445695366E91AE0B561206A7D38A0F855D66196F292AF4699A53CE76B53E62B5755AF507EA9FC405BAD4C532FF760552B7FEFEB00FDA0670360B3BE45E92E69DEA7B0CEBB459ACD12F483808F280565BE8C855602B93D4DE57644A9AB66F8B0FF387ABE43F9A4D2A66E44655EA9DE1A7E4CE956FF51FBA672A97A9FFF7B8027AB9F01E44CD8A56EA7E7A80D339E52122AC3B4BAC5FF6365979A327E0EF849DF6BCA018CFAAD32A6D6EABF137DFE0CFA7B344D3DA2FE6B55957AA9F2FED06CC0AFC0AB37A97BE83CF526F5E5AA65808F6A6B54F6ED76C0BDCAE5EA31CC95547781B20FD0A1BC5C358E367B609712D235EC171C8BB4C0E3EAABDAADEABDEA78F576C046F54EC083C17BD403CA2EFD9368EF467BA5787EA5787E0CA39E50C7954BD4EF826E8599FEB85F534EAADCE7A4CA7DC695ACF1ACFA2FEA12ED67E8D9AEBC06B81C678131F1C0499563DAA69CAC6EF030E55C0FE7498BE705F5D1EA36CF1150967B6E52D86F3729AFEB17795E569F09ACF39C549FF16DF2EC526FD376817247B8C573A97A63F8168FA25E1FBA1DB019B3FF523DE9BBC7F320711D7E90B8FE3E485C697FAF3EA37CD9B354CE2BABE8B3BE2D386D3DECFB2DDAEC01837AA906F5FE6ECAEAAD382F26518B6B290338836E009C4D370336D33F002E1178A1503AE913809708A54FE0E5F43860925E05DC4F7FF4AD45DDAFF1AEA543D4A575528E7A00B9DD8DB9DEAE278592144A1A940FE805E97F1DDD20F00302B9CF1170EFD0EF10EEDDC2BD1BF4BDDADDF44FD2BE4F20F73F0E691EFD11E9F998D01F43CF7BB4C7847E52E0F3C27D51E4BC28A35E14392F4A7FBF72377D46BF4E11AEC2148FCA1A7AD4DBA84A9F2DEDD92ADBDBA932778FC6943D1ACB2C48BB20ED3BA47D87B41F91F623D27E5E20E90C632E64EE5A69EF71A1F497F6C5B40D95F14A78F5DDF441BA871EC37AEC574CE506E556E5D34AADBA40BD505DA7E6D577AB0FA8BF51FB3D239E5B3D7FEFF9B4E77ECFE73DDFF278799FC11F3E49E98874446EB1AF072EC0DEF61B630DE097025D80FF16EC067C5760336093A70FF053E15D3EBE1B30FCB972A54FC5FEE191EF3FF900599E8A1FBFBC6D0FCA7BFF10FF6E1B50C54F3560985F29E0945F4B8FE89FD53763BF5F86BCEBA4473DDFF7FCD4F30BCF1F3C6B950BE99B2185D62BAB699FAA52A7B2865655F3B3939E0BF3AD661D3D15E62D673B7DD42F77797ACCE067BFF423659CE60BFF3ABA02B8B750F1AD2CF93CE9A7F2F7DEF039ED59281D26D29C7B57A082A6E3BE7C663FDDFB756DF2D8CE50B1CD03EEA9E277125E7E818CFB5400B687B0BF8470DB09E3EC5447CC3D977E2A4F4B9EFC9BE59FD212E509CF12E535E7DB75894534A77BEB8A856DD4BF29313C904ACCE9EF17745B1B755A59FE5ADC6589CCA8B9079421DB4CA4FA127BCD2D03FBCC64BED7B6AE4AA74C1BACED39D35EB298469DC736AB3B9BE7E7621A34F3FDDBB7AD5F41AB7AACD468C6BC8856F5DAE9AB1279B37B7824630E9BD97C229FB6B25D663E91CEE42EA2BE0E1AEAEAA40D9DD4DDD5459DDBB7F66DD9DADFB771CB8EEECD1B682374A5DE2DDD9BB7B5F776A31AF4F56EA2BE4DD4E3F6EBDEBC7E0BF58DE5F2E6706BF716549A4BA9A38F7AFA90D53BE99275BBA8BF3363E5466D133652573A3762E5CCFEFEEE6C2E9FC826D1A24E18989F4882916C6B57229FA0E15CD2B233E901DA6A66CC44CEDC984AD20633CF8F9E74D2B672D6DE7CEB65E9DC6822D391C8A5517392D4610EA6B35BE137D77DB435BD2F9B4A98999E44363168A6C44370741693004BE72ADBD0315942FBC6B2C921DBCAA6AF615E8A86766441340186AE06E8B4864712B6D963E687AC946B49D10E99049A96F094B937319A29E3E96283CD49E4863AAD9449390CEAE1068BB6CD5C0E7172F0F4C890694BB30F9E48E6A5B9DEB686BB8761130B711A3C6D0F06729B352DB6BB1DE7270632266D1DCDE6D3C3E6B6B1117363229BCAC870C6589E4B19721E5B3155223B88D6FA34C00E3B9D3737A5B3EE3CAE10927495166297B792564610572AF559C9FD6E535C0F372023C4D8621BB65AA376D22CE29D891179B68F8C64D249C957C47702DE67E6F3FCDE50E89C656631C1685D2A9DB7EC0EDBBA5A0CEE43C2BBBA8B636189BDC1CC9A36C8A9F67CDE4E0F8C82B561345D816D343323979863575B766597E2288E5699DC650E8C0E0E9AF6662BCBCBF26C4CD6A34C3B43C13203EA219BD31368EDB99C393C9019DB96CE57926115B2DA4E39ABBC4271140887B639317C36317622650E27ECFD65D6B6848DC0ACB7D11FF6EE9F6C1864A6CCEC64599C14979936A76999D933B6C1B646473AAD0C27EA0456715C97994BDAE991894C2734125BACF6C44169E5260F468EA54693F9C98C4E6B64CC4E0F0E9D9585A59A1D2B33DC3520F47C7A209D49E72BB8922B1D63EC1A4B1E9CB792E592B54E0BE9ED546507ED4B5C85C066535832661A4DB70C39088FEF4319A1E4803C580A2FCF8ED1BD7B4DBB4472BB575219706BCB5EEA45BA178BAD53DA98B02E9BB452159C2E3B7135D056AE071564D7E056375CCCE1E5CEAB67F952E7153C1B5B89BAF5ADC4741BB0DB6D4D9C113D365978F4E40651B7079DE41121702997B862DB192D94F5995140485C6F65B0AFF526F243E2AB1DE994DBDA646607D1745CE22223C9340D5CB61FD14581EE4C64320389E47E426267737B2D7B787D3A8BED2083AA433D093B3794C89C7DB368ED19EB33EDABD24933D78AEDD3B431AC6813AB6A65B15772A1CDB8DB6C6B2A830E1B3B2DDB94E65673D8CA9B48E6FD796B4428BD487ADAB03B3D021BCDC430F5A0873DE6226C4E6F02AB8C32CEE36AE7E14C89C7F0B009D724DB33831612706898D847656CC0CAE7AD61EAEEB4C746F256C9DC52F1C4FE46037D494004D2B2B0616689D704C7B92F699B665662E7B444193B8D4230E652CE6A792BAC4B0F66A937338A6CA2A16EEC8EC401974669E76FADD8B0447445A14641A8C458A3DEF44133B365846B69DAAA9839BB373D383A91B821630D2432E96B2610B79A7BDDDA22CBA6D7CAA505597730698E381D9376961739A5AE5E77306F27BAB37B2D922D92AB73525077B391361C230BC9B48B68E7A89DB31C6CB7695BD491CE0F2746A82F639A2362E2366B64620694BD0B7B2961534FD73227566E9A158F6F34CCFE9978A4038DF78E494477CD4C66F48CED30078AF97B06B76FC44CA613196751916B98BB8644F7ADE594814B6CE7FC6872AB148B94D96539D9C0FBA5EC87EE60D6B3285432D8CC0B8121BC84305E65DA79B773517F6441A9D989D4B4DD63DE3ADBB630AB999F800F39DEA77604194757B45A930E94470F0A183FDBD7F5F5779949F1B1ED9EC0CA3873A1E6046E19DF0E8B7BF3366DB0132343E964AE54CDD289C1AC95CB33890DE8B046B3A9DC1B54902E53DCEFD4AC7238684270DE60EC84B38CDBF38C622D55C91AF92B828A317A23296FC8779320E7AE6ED4C3C9B412A1D52EB19C63016A38970868E59C3173CEB6D99EC9F09699E3D5E034B2EB3389C19C7B0C74DAA9AB9DE75E87E3FE06587649F758475C9CDD2696BB699B382CAF3B00A34BFAEF4867533841B5AE47117406636E6701E6C8C942AE47394A768CA272A231E2AE4F140C273987B03F940ECF6E4AE78A870327E57393523D474EE9B2D07212174EC9758DA4DBAFC67699459B12A556B130C269C962D3D57FB3996F759C22EA2215480A23DB8336D4722CE44338392B1C5E71D709B9E72BE79CE15E61B01530279346F97624BB7BE8DE3C651830B6D1E43312C94989AC91FE7507390FD379540D9C825043018652C98E8CD3BDCBB9B850B7ECB6480746D665AF4AE362C49749DA6F8E0DA4FACDABB83D6C61A774DBBD569A61D16B7C8972EFB3F9849D7703C4DD00DA07186EC4B2C3C50845A274CCE17F23C64550AEC5CE41C136076D5E938E73DC12EC22D8D1B2AED72875B09CD72870EDB69D18A3D498EC1838D917A7E83393A3C8DBB156A7540F72391873B2C93D3C527B2AC5715B9F184E03BB143988FEECBAEEAC79C0C5CAE98A00213D40C267562FE1F0408394A62CB5D256C2898E2C506C4A4A9BF4ADD4450B49E17703C15EEAA6CDB481D610D5F5A1878DBE19FCE9C2F36A48A04825753B8D104DED44CB82241C138567E24FD695DBEC3E774236F74BA3C77ED02E411FE817E9121DF6A307CB8434CF5B31739A8629019D4D3A8FF6816ACAF71BBD97DFD039F8AB0B7B6EDEFCF8EB0F9FFC4E8EBC3145313C31527C6844228C8619A8BE98AA84C3426DD7635EB4C361AD2EDAA544AB9C87E13C12CE63AD5707C71BA35AE296C120C160ADAE7BA2D7AAD16B7DA4AA8D8D3A29D174A4F0942F46D1C2F7749E044F1F3A16C60DF00AFF82BF3CAE8115686CD0A040B4F09CA6AB8DD1C2518D183B0A7DC35E34E5F55395EE3522856391C247C0A98A799448E1E548E11791C22FD1C5088B1D8646D4142DFCC947C43046E82DF018FA84D97EC3874653B826A6450B7736F90C2332EE8F8EFB1AAB75BF6AA8FC89168EB00631C5400F18DAE4C3D88038CBA7635A1E04410147E38F32BD51EC3A0A0DA3855B9A7C4D3E2070033C09C3554C1109C4BC863B5B987B1D2DFD0DEB9A5A1EA5B2B92C5EADD1834DE1B0BF416D50551F7C7734405E10C210314B238F110EABAAD6C0CE6E10171A063B2D32DE06092A7BCD1756B569A08523E3ED18C07185ED4DBEB046F05493AF5A8781C7E1ADE3067F54C775C71193261FFB6FBC1B4981EE1E5DE1F490111A2B095D31F213E805D39BD827621AC4F2D30F5DA2E3A1C8F8A57087DB1DBD656A23EA48B8375AF86CB4F0A058ACF1244D3EF66664FC0A4997078D98876906FAEBD1C24312F287A28547239BE04D8480FD98902C7A343A6E86629AC21670728CA73191114DC3830DB3F5900CBB255A781C86450B27E1E8A38D6A3189403FEA87FF043FE6E86D3AA9A2347AB5E8F8015D6807106A76CDE3ECB8C61A95730F163A22259D7C358E9E3BA1B128DA30470F3756CE3C61D6875427F498A8010B48F51B48228F014773F81B1B81A98DC06471A57DBA3A135ACE245F8D4233C91B506612D65A2D56A02A6BB296743C87F1741F6A2DF7AA258E0F3038F2816BDE7AD9B4A5CF1F313EB5A6FFED91EF052EF0CA17A6DC75EE3E0DF799709F6B3D5AF45AF8A1308E4603378EA81A924AE5E64DAA16F02098DCBE45D50C74D9C8ED8F7AB448AF17E953C5C0609060B096C1B5B22EC79DD53DCE9406837C8D61A93942BC13FE5464C519864EDE8606A3A1018BBF41E3601F0FA3B7849A79AACFE7E7FC96EC41CED7443631B5C1309CDE0F190671913886E54A6438B4069DD446A661063FD63445D37A8D028FC2A78B1445A999C92FD31B1A6A223BB166D0F07B0DB6C5605B0CB6C5605B0CB6C5605BB8D9E08D231886E2FE0BEA99FC4BD96D6AFD0E6C4E9BAD6CE99A83FD14072005FD9CAFA645150A4DBC92C85772B04B28142DBD1E897DE9782CB678D1E2C544F3159AB378E5DEF3CF4F2C4E2C34932BF62E5C9A5C965CB862E5CAE4C2C5CBDB12038915CB536DE6F9445598A3AD7511FF21DAA0D0F4D6CDEBB6955E19B5B8AF1556F337FEA06A784A89C52FE53289317E1955C36362254E6CA951FCE2538342819EB16DE630BAE64DA3AD3453BB424BCE3CAEB66EC3E536D78A53A3951DCC8CF18BC55491D9319AE63B8FD1B6BC2861B742979C796EEECB8FA6D256ABF31A0E92DC9DDBB9EB9A7689D097E6779FFC96CB7DF367D97E486E73451B8AFBCDC084424B8B875273A0B5F456A1F83A14535889918DF9FC8873362BD2A3935F7FD79EED2D3911166A10C7F3D2158A6A150A835079B396188126F7B36287CA7B48514AE960CD1FFE27A1DF7CE2D52F72206EC24F6692BB8B2D7EA76EDA2DB1E24BF9965831EA4B1D67B7C4DC2BF5EAAC398A4B77A625D63B3A00FD70DCDA66ED37B3AB079069CB92CB96B7AD5CB2D45CB462E5ECC9933967EF2201AA56FE9F00BDED5DFC97757EBEBF4C7E9DDB313AEBE795FE4A0C4749BB2B93E949A4B3CE2F174CE7550E7FFE3C17326ACE2AE47F3EFF9F7C9CEF683714FF978D0A3AAF8F4567A1F387FFEF889DE0ACAAF8FF335679F84B4D97E154DE0FB80E67FF3E9CEEB7E07CDF2FA7FCF5CEFFBA410F795F3D4DEE776E2A65AE7131FE7DE419FF2D867C875981D404CEEDEB71AACFE08CDE8D53FF5EF91714447364D4367013A0E6C04F106E56E0665D099FF27E58BEEBD307BA2DB793C1B3483A287D1695FE2CA501F77BF3EC8F4EF419C61FBE6FE429E74A3EB7823722F38FC1DA84F42BEBCFDF542DCEE7DC4292A2C7C8043DF9BE340C2C5FEAB51F6DB9A9400FA342C665F8B1C12F8F6DC37D6B51E987E7E46FC0768BAEDC370B9D32159ABDF15CAD9492FB16C799656C921B118FEE14FE98683E4843C4FF9FC9645A8C8EE327468BF9FB6BC45FB45B203E2ACB712295120D38A6FB4BDE24F4E239B7B8F2D2AEDE45BBB3FF29FD5789DF7BE5B697C22D34891E95B1F94BFE5E2AFE9E38F64CAF9FE9F31532A61D3D722279005A8CC1137F6DDC7FEB678FF36F15AAFEDB27FE9FCFFF0B9FFF00182C66F0004A0000 | |||
Executable files
1
Suspicious files
1
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6024 | Rust.exe | C:\Users\admin\AppData\Roaming\wusvcs.exe | executable | |
MD5:191B838B8DDC7C8AA5CD9731D1C329B8 | SHA256:646AC6C8F86341DD6B9184568E6A18C1B7FB99EFBEAFB46C5D4CAEFF25246D80 | |||
| 6024 | Rust.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wusvcs.lnk | binary | |
MD5:925A3F22EA129437C7D47700D461CD45 | SHA256:A88069489926857D226F0C796C420EAD39731280481EAEC3C74ECC7EE6C23978 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
37
DNS requests
18
Threats
12
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.164.49:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4376 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6896 | SIHClient.exe | GET | 200 | 23.218.209.163:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6896 | SIHClient.exe | GET | 200 | 23.218.209.163:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6944 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5488 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1248 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4360 | SearchApp.exe | 104.126.37.131:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6944 | svchost.exe | 2.16.164.49:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
6944 | svchost.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
6024 | Rust.exe | 147.185.221.20:53788 | 20.ip.gl.ply.gg | PLAYIT-GG | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
20.ip.gl.ply.gg |
| malicious |
login.live.com |
| whitelisted |
th.bing.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2172 | svchost.exe | Misc activity | ET INFO Tunneling Service in DNS Lookup (* .ply .gg) |
6024 | Rust.exe | Malware Command and Control Activity Detected | REMOTE [ANY.RUN] Xworm TCP Packet |
10 ETPRO signatures available at the full report