Analysis

  • max time kernel
    154s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2022 12:47

General

  • Target

    rdpclient.exe

  • Size

    113KB

  • MD5

    9c740b86ddaa775797e60f9197b74858

  • SHA1

    8e0138cc5788d81c7937e609f43a11415635bab7

  • SHA256

    d4b81ee9f7f012676c701b3ef9f98a6d6f224db9501ea40cc4fd5991844fe723

  • SHA512

    c2cb8a6e91db5b5fb53ebe4393724e1a74316ef8e375a084642859f20cd0974cadb50becd903d9ef837637bfc7fd08af333306fdb0ad9d7b70c0e114a5e60b8d

  • SSDEEP

    1536:lxhjsDHJeT2vXuhi3ugvXjQzZ28Tx4rUbu60miVP0tp2s8r9oRgzwS1q1Qv:lW49U39sHTx4rd60tZEMrORgzwS1qyv

Malware Config

Signatures

  • Azov

    A wiper seeking only damage, first seen in 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rdpclient.exe
    "C:\Users\Admin\AppData\Local\Temp\rdpclient.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:3656

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3656-132-0x0000018F932D0000-0x0000018F932D4000-memory.dmp
    Filesize

    16KB

  • memory/3656-133-0x00007FF796460000-0x00007FF796477000-memory.dmp
    Filesize

    92KB

  • memory/3656-136-0x0000018F932D0000-0x0000018F932D4000-memory.dmp
    Filesize

    16KB

  • memory/3656-135-0x0000018F932C0000-0x0000018F932C5000-memory.dmp
    Filesize

    20KB

  • memory/3656-134-0x0000018F932A0000-0x0000018F932A7000-memory.dmp
    Filesize

    28KB