Analysis
-
max time kernel
149s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21-11-2022 12:47
Static task
static1
Behavioral task
behavioral1
Sample
rdpclient.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
rdpclient.exe
Resource
win10v2004-20221111-en
General
-
Target
rdpclient.exe
-
Size
113KB
-
MD5
9c740b86ddaa775797e60f9197b74858
-
SHA1
8e0138cc5788d81c7937e609f43a11415635bab7
-
SHA256
d4b81ee9f7f012676c701b3ef9f98a6d6f224db9501ea40cc4fd5991844fe723
-
SHA512
c2cb8a6e91db5b5fb53ebe4393724e1a74316ef8e375a084642859f20cd0974cadb50becd903d9ef837637bfc7fd08af333306fdb0ad9d7b70c0e114a5e60b8d
-
SSDEEP
1536:lxhjsDHJeT2vXuhi3ugvXjQzZ28Tx4rUbu60miVP0tp2s8r9oRgzwS1q1Qv:lW49U39sHTx4rd60tZEMrORgzwS1qyv
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rdpclient.exedescription ioc process File renamed C:\Users\Admin\Pictures\EnableRead.crw => C:\Users\Admin\Pictures\EnableRead.crw.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\ExitTest.raw => C:\Users\Admin\Pictures\ExitTest.raw.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\RegisterGroup.raw => C:\Users\Admin\Pictures\RegisterGroup.raw.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\RenameCopy.crw => C:\Users\Admin\Pictures\RenameCopy.crw.azov rdpclient.exe File opened for modification C:\Users\Admin\Pictures\ResumeApprove.tiff rdpclient.exe File renamed C:\Users\Admin\Pictures\ResumeApprove.tiff => C:\Users\Admin\Pictures\ResumeApprove.tiff.azov rdpclient.exe File renamed C:\Users\Admin\Pictures\UndoRestore.crw => C:\Users\Admin\Pictures\UndoRestore.crw.azov rdpclient.exe -
Drops startup file 1 IoCs
Processes:
rdpclient.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RESTORE_FILES.txt rdpclient.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rdpclient.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run rdpclient.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" rdpclient.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rdpclient.exedescription ioc process File opened (read-only) \??\I: rdpclient.exe File opened (read-only) \??\O: rdpclient.exe File opened (read-only) \??\Q: rdpclient.exe File opened (read-only) \??\W: rdpclient.exe File opened (read-only) \??\A: rdpclient.exe File opened (read-only) \??\B: rdpclient.exe File opened (read-only) \??\S: rdpclient.exe File opened (read-only) \??\V: rdpclient.exe File opened (read-only) \??\Y: rdpclient.exe File opened (read-only) \??\F: rdpclient.exe File opened (read-only) \??\J: rdpclient.exe File opened (read-only) \??\K: rdpclient.exe File opened (read-only) \??\L: rdpclient.exe File opened (read-only) \??\M: rdpclient.exe File opened (read-only) \??\X: rdpclient.exe File opened (read-only) \??\E: rdpclient.exe File opened (read-only) \??\G: rdpclient.exe File opened (read-only) \??\H: rdpclient.exe File opened (read-only) \??\N: rdpclient.exe File opened (read-only) \??\P: rdpclient.exe File opened (read-only) \??\R: rdpclient.exe File opened (read-only) \??\T: rdpclient.exe File opened (read-only) \??\U: rdpclient.exe File opened (read-only) \??\Z: rdpclient.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rdpclient.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01585_.WMF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Origin.thmx rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Srednekolymsk rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml rdpclient.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo rdpclient.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\calendar.css rdpclient.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\sqlxmlx.rll.mui rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0229389.WMF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21344_.GIF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh.htm rdpclient.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\[email protected] rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099163.WMF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02742G.GIF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_K_COL.HXK rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\LAUNCH.GIF rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+7 rdpclient.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_OFF.GIF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGMARQ.XML rdpclient.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\localizedStrings.js rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099175.WMF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18212_.WMF rdpclient.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi rdpclient.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\RSSFeeds.css rdpclient.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous_partly-cloudy.png rdpclient.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\EDGE.INF rdpclient.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\FRAR\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize rdpclient.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up_BIDI.png rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WSIDBR98.POC rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang rdpclient.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\RESTORE_FILES.txt rdpclient.exe File created C:\Program Files\Windows Media Player\de-DE\RESTORE_FILES.txt rdpclient.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PROPLUS\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00351_.WMF rdpclient.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0188669.WMF rdpclient.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\settings.js rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\DELETE.GIF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AD.DPV rdpclient.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv rdpclient.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar rdpclient.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCellMCE.lnk rdpclient.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AXIS\THMBNAIL.PNG rdpclient.exe File created C:\Program Files (x86)\Common Files\System\de-DE\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_left.png rdpclient.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt rdpclient.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe rdpclient.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_down.png rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\content-types.properties rdpclient.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Riga rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00369_.WMF rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01169_.WMF rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG rdpclient.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTORE_F_COL.HXK rdpclient.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1328-54-0x0000000000290000-0x0000000000294000-memory.dmpFilesize
16KB
-
memory/1328-55-0x000000013FD40000-0x000000013FD57000-memory.dmpFilesize
92KB
-
memory/1328-58-0x0000000000290000-0x0000000000294000-memory.dmpFilesize
16KB
-
memory/1328-57-0x0000000000100000-0x0000000000105000-memory.dmpFilesize
20KB
-
memory/1328-56-0x00000000000E0000-0x00000000000E7000-memory.dmpFilesize
28KB