Analysis
-
max time kernel
159s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2022 12:49
Static task
static1
Behavioral task
behavioral1
Sample
rdpclient.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
rdpclient.exe
Resource
win10v2004-20220812-en
General
-
Target
rdpclient.exe
-
Size
113KB
-
MD5
8737c6601c30b2ed49b51d6b53e2ea3e
-
SHA1
d9521390d87bd895c78d16f573bfa6863ce46e2c
-
SHA256
9a952abaa9e8bc4676e2c8e53774d15198e4b9163bebf37a0bc2e238e49f2f98
-
SHA512
ab451844a8d6d57e34b2825db9bc8c669a1dd83db6bb7d98b37919da26a45b815d9c1544eed00eea8190255dc9edc7f42cdb5dde8f92b9df14309a3cbcad1ec2
-
SSDEEP
1536:lxhjgDHJewOvXuhi3ugCXjQzZ28Tx4rUbu60l+uMh8c9n5P3vrOTaTlonDQgWPI:la4aU39FHTx4rd60fS8cd5P3viCYDQ0
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rdpclient.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run rdpclient.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" rdpclient.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rdpclient.exedescription ioc process File opened (read-only) \??\B: rdpclient.exe File opened (read-only) \??\F: rdpclient.exe File opened (read-only) \??\G: rdpclient.exe File opened (read-only) \??\J: rdpclient.exe File opened (read-only) \??\L: rdpclient.exe File opened (read-only) \??\R: rdpclient.exe File opened (read-only) \??\E: rdpclient.exe File opened (read-only) \??\X: rdpclient.exe File opened (read-only) \??\Z: rdpclient.exe File opened (read-only) \??\S: rdpclient.exe File opened (read-only) \??\A: rdpclient.exe File opened (read-only) \??\H: rdpclient.exe File opened (read-only) \??\I: rdpclient.exe File opened (read-only) \??\N: rdpclient.exe File opened (read-only) \??\O: rdpclient.exe File opened (read-only) \??\P: rdpclient.exe File opened (read-only) \??\Q: rdpclient.exe File opened (read-only) \??\T: rdpclient.exe File opened (read-only) \??\K: rdpclient.exe File opened (read-only) \??\M: rdpclient.exe File opened (read-only) \??\U: rdpclient.exe File opened (read-only) \??\V: rdpclient.exe File opened (read-only) \??\W: rdpclient.exe File opened (read-only) \??\Y: rdpclient.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rdpclient.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\VERSION.txt rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png rdpclient.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-core-multiview.xml rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveDrop32x32.gif rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-modules.xml rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.GrayF.png rdpclient.exe File opened for modification C:\Program Files\7-Zip\descript.ion rdpclient.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\feature.xml rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedgewebview2.exe rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProDemoR_BypassTrial180-ul-oob.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe rdpclient.exe File created C:\Program Files\Java\jdk1.8.0_66\include\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyoptionaltools.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-ul-oob.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\sunpkcs11.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.security.ui_1.1.200.v20130626-2037.jar rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-pl.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.shared.Office.x-none.msi.16.x-none.xml rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-phn.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\SmallLogoCanary.png rdpclient.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\chrome_installer.exe rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml rdpclient.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN081.XML rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\strings.resjson rdpclient.exe File created C:\Program Files\Common Files\System\Ole DB\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\nashorn.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-pl.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat rdpclient.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-swing-tabcontrol.xml rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-pl.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar rdpclient.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ul-oob.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-phn.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-common.xml rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-ul-oob.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms rdpclient.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK rdpclient.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml rdpclient.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4800-132-0x000001A1D7FA0000-0x000001A1D7FA4000-memory.dmpFilesize
16KB
-
memory/4800-133-0x00007FF6F8050000-0x00007FF6F8067000-memory.dmpFilesize
92KB
-
memory/4800-134-0x000001A1D7F60000-0x000001A1D7F67000-memory.dmpFilesize
28KB
-
memory/4800-135-0x000001A1D7F80000-0x000001A1D7F85000-memory.dmpFilesize
20KB
-
memory/4800-136-0x000001A1D7FA0000-0x000001A1D7FA4000-memory.dmpFilesize
16KB