Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2022 12:48

General

  • Target

    rdpclient.exe

  • Size

    113KB

  • MD5

    cb36414aa635a55c46da102f64e68667

  • SHA1

    6a16c156b4e937e16961606c9e2c0bf982d7994b

  • SHA256

    f26a427105cba33da30a7e345f398c0808ad350875ff6bc1790b17132a1c0405

  • SHA512

    ce3d5124c7ded7b2a5a0d4d10c7fbbadd290af056cda0761a3e9c9864a91b561cae2d55ac5e369db15454e8236395e1fdf59a8a0b6614132bd9d41694117359f

  • SSDEEP

    1536:lxhjZDHJex1vXuhi3ugzXjQzZ28Tx4rUbu60z0aleVrk3kCNUGG4XsEjUyOyI7:lF4qU39YHTx4rd60zrley3IGGOsEjUV7

Malware Config

Signatures

  • Azov

    A wiper seeking only damage, first seen in 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rdpclient.exe
    "C:\Users\Admin\AppData\Local\Temp\rdpclient.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:3648

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3648-132-0x0000021E947F0000-0x0000021E947F4000-memory.dmp
    Filesize

    16KB

  • memory/3648-133-0x00007FF7BBE50000-0x00007FF7BBE67000-memory.dmp
    Filesize

    92KB

  • memory/3648-134-0x0000021E947C0000-0x0000021E947C7000-memory.dmp
    Filesize

    28KB

  • memory/3648-135-0x0000021E947E0000-0x0000021E947E5000-memory.dmp
    Filesize

    20KB

  • memory/3648-136-0x0000021E947F0000-0x0000021E947F4000-memory.dmp
    Filesize

    16KB