Analysis
-
max time kernel
154s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2022 12:47
Static task
static1
Behavioral task
behavioral1
Sample
rdpclient.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
rdpclient.exe
Resource
win10v2004-20221111-en
General
-
Target
rdpclient.exe
-
Size
113KB
-
MD5
9c740b86ddaa775797e60f9197b74858
-
SHA1
8e0138cc5788d81c7937e609f43a11415635bab7
-
SHA256
d4b81ee9f7f012676c701b3ef9f98a6d6f224db9501ea40cc4fd5991844fe723
-
SHA512
c2cb8a6e91db5b5fb53ebe4393724e1a74316ef8e375a084642859f20cd0974cadb50becd903d9ef837637bfc7fd08af333306fdb0ad9d7b70c0e114a5e60b8d
-
SSDEEP
1536:lxhjsDHJeT2vXuhi3ugvXjQzZ28Tx4rUbu60miVP0tp2s8r9oRgzwS1q1Qv:lW49U39sHTx4rd60tZEMrORgzwS1qyv
Malware Config
Signatures
-
Azov
A wiper seeking only damage, first seen in 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
rdpclient.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run rdpclient.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" rdpclient.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rdpclient.exedescription ioc process File opened (read-only) \??\M: rdpclient.exe File opened (read-only) \??\P: rdpclient.exe File opened (read-only) \??\T: rdpclient.exe File opened (read-only) \??\Z: rdpclient.exe File opened (read-only) \??\B: rdpclient.exe File opened (read-only) \??\E: rdpclient.exe File opened (read-only) \??\F: rdpclient.exe File opened (read-only) \??\V: rdpclient.exe File opened (read-only) \??\X: rdpclient.exe File opened (read-only) \??\Y: rdpclient.exe File opened (read-only) \??\G: rdpclient.exe File opened (read-only) \??\I: rdpclient.exe File opened (read-only) \??\L: rdpclient.exe File opened (read-only) \??\W: rdpclient.exe File opened (read-only) \??\H: rdpclient.exe File opened (read-only) \??\N: rdpclient.exe File opened (read-only) \??\S: rdpclient.exe File opened (read-only) \??\O: rdpclient.exe File opened (read-only) \??\Q: rdpclient.exe File opened (read-only) \??\R: rdpclient.exe File opened (read-only) \??\U: rdpclient.exe File opened (read-only) \??\A: rdpclient.exe File opened (read-only) \??\J: rdpclient.exe File opened (read-only) \??\K: rdpclient.exe -
Drops file in Program Files directory 64 IoCs
Processes:
rdpclient.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe rdpclient.exe File opened for modification C:\Program Files\CompressEnable.mp4v rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs rdpclient.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt rdpclient.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt rdpclient.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-hang-ui.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\net.properties rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\blacklist rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\ir.idl rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html rdpclient.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt rdpclient.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml rdpclient.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css rdpclient.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt rdpclient.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-openide-options.xml_hidden rdpclient.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\core\locale\RESTORE_FILES.txt rdpclient.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.http.jetty_3.0.200.v20131021-1843.jar rdpclient.exe File created C:\Program Files\Common Files\microsoft shared\ink\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-attach.xml rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml rdpclient.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml rdpclient.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\it.pak rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_zh_CN.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-spi-quicksearch.xml rdpclient.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\SmallLogoCanary.png rdpclient.exe File created C:\Program Files\Common Files\System\ado\en-US\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_es.properties rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\classfile_constants.h rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi_3.10.1.v20140909-1633.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-actions.xml rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\unpack200.exe rdpclient.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar rdpclient.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\tzmappings rdpclient.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\RESTORE_FILES.txt rdpclient.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png rdpclient.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3656-132-0x0000018F932D0000-0x0000018F932D4000-memory.dmpFilesize
16KB
-
memory/3656-133-0x00007FF796460000-0x00007FF796477000-memory.dmpFilesize
92KB
-
memory/3656-136-0x0000018F932D0000-0x0000018F932D4000-memory.dmpFilesize
16KB
-
memory/3656-135-0x0000018F932C0000-0x0000018F932C5000-memory.dmpFilesize
20KB
-
memory/3656-134-0x0000018F932A0000-0x0000018F932A7000-memory.dmpFilesize
28KB