Analysis
-
max time kernel
162s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2022 12:48
Static task
static1
Behavioral task
behavioral1
Sample
rdpclient.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
rdpclient.exe
Resource
win10v2004-20221111-en
General
-
Target
rdpclient.exe
-
Size
113KB
-
MD5
0de8c69f60e0469a56b9d9b4a3cac9c7
-
SHA1
d7d44c64e7ce5973815327cc2218340dd38363b5
-
SHA256
e2ca30b2a5d896a6386d7e93addef74499fdcec1be625f8c21bfb7f6fbf83794
-
SHA512
e7e4a7b96b6126a370d707d811fff03929bd2113f01c254a909deeb8df7e1a2697f33a9dcdcf449e01344a757e6b8eeb960c9f4088d0d2a8d6f1497ff30a24d1
-
SSDEEP
1536:lxhjrDHJeUDvXuhi3ugHXjQzZ28Tx4rUbu60CNznelEWn4w6T8fW37yimIgHL65G:ln4FU39EHTx4rd60CFnwn8lU65s3
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rdpclient.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run rdpclient.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" rdpclient.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rdpclient.exedescription ioc process File opened (read-only) \??\H: rdpclient.exe File opened (read-only) \??\I: rdpclient.exe File opened (read-only) \??\J: rdpclient.exe File opened (read-only) \??\O: rdpclient.exe File opened (read-only) \??\T: rdpclient.exe File opened (read-only) \??\V: rdpclient.exe File opened (read-only) \??\X: rdpclient.exe File opened (read-only) \??\K: rdpclient.exe File opened (read-only) \??\L: rdpclient.exe File opened (read-only) \??\A: rdpclient.exe File opened (read-only) \??\E: rdpclient.exe File opened (read-only) \??\F: rdpclient.exe File opened (read-only) \??\R: rdpclient.exe File opened (read-only) \??\S: rdpclient.exe File opened (read-only) \??\Y: rdpclient.exe File opened (read-only) \??\W: rdpclient.exe File opened (read-only) \??\B: rdpclient.exe File opened (read-only) \??\G: rdpclient.exe File opened (read-only) \??\M: rdpclient.exe File opened (read-only) \??\N: rdpclient.exe File opened (read-only) \??\P: rdpclient.exe File opened (read-only) \??\Q: rdpclient.exe File opened (read-only) \??\U: rdpclient.exe File opened (read-only) \??\Z: rdpclient.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rdpclient.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe rdpclient.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fontconfig.properties.src rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\rt.jar rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.169.31\MicrosoftEdgeUpdateOnDemand.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar rdpclient.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB rdpclient.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\NetworkServerControl.bat rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\ffjcext.zip rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\platform.xml rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\feature.xml rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\epl-v10.html rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe rdpclient.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.zh_CN_5.5.0.165303.jar rdpclient.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_hu.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\java.policy rdpclient.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man rdpclient.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\cursors.properties rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.properties rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.jdp_5.5.0.165303.jar rdpclient.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt rdpclient.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt rdpclient.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe rdpclient.exe File created C:\Program Files\Internet Explorer\fr-FR\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_it.properties rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.rcp.product_5.5.0.165303\feature.properties rdpclient.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt rdpclient.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe rdpclient.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateComRegisterShell64.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management-agent.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\about.html rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\sRGB.pf rdpclient.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt rdpclient.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt rdpclient.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml rdpclient.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\external_extensions.json rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe rdpclient.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\cldrdata.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunpkcs11.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfxswt.jar rdpclient.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-CN\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe rdpclient.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fa.pak rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\psfont.properties.ja rdpclient.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\RESTORE_FILES.txt rdpclient.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\RESTORE_FILES.txt rdpclient.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe rdpclient.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe rdpclient.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1544-132-0x000002B2146D0000-0x000002B2146D4000-memory.dmpFilesize
16KB
-
memory/1544-133-0x00007FF6D0AF0000-0x00007FF6D0B07000-memory.dmpFilesize
92KB
-
memory/1544-134-0x000002B2146A0000-0x000002B2146A7000-memory.dmpFilesize
28KB
-
memory/1544-135-0x000002B2146C0000-0x000002B2146C5000-memory.dmpFilesize
20KB
-
memory/1544-136-0x000002B2146D0000-0x000002B2146D4000-memory.dmpFilesize
16KB