b9af69ac821a649f211c99e3edf32a76a213e9450b5e972a6cdda5758af530dd | Triage

Resubmissions

23/08/2024, 16:00

240823-tf47dsteqe 6

23/08/2024, 15:32

240823-sy293sseld 4

23/08/2024, 15:18

240823-sp1d5athqk 8

23/08/2024, 14:12

240823-rjcv7sydnd 7

23/08/2024, 02:33

240823-c17dta1cpd 7

23/08/2024, 02:11

240823-cmbpzszelg 4

23/08/2024, 02:00

240823-ce59mazbnh 4

23/08/2024, 01:37

240823-b1992a1dmm 5

23/08/2024, 01:24

240823-bsm5jazhpp 5

23/08/2024, 00:51

240823-a7p21awhld 6

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 15:32

Sharing

Report Analysis Logs

General

Target

RdpSaUacHelper.exe
Size

56KB
MD5

4ac9a3d3d12da0ef45c00779dc18d40f
SHA1

f0e4a3247f265abc5ba93c64e47d23f6f2cad7d7
SHA256

e06b5a8e82100d8bfd5acf5a429bf4b4c38f2f51b779cbaca9340a8f1daca824
SHA512

9007aa2f049ef768dfb7758ca6261112efa34ec9f1a5415f85833848f0c96cf5baed3398d78ba309903e82b0a7ea6bd05eb7a6e87c545e782630c843fb1b9e43
SSDEEP

768:N/P4JjdINwnubT4fN6NAFxJ43vG5wjF9VgXZj5Z2Tnw:NX6pjuQfN6NAfJuG+HOXLZ2Tn

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3300	RdpSaUacHelper.exe
3300	RdpSaUacHelper.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3244	4272	RdpSaProxy.exe	88
PID 4272 wrote to memory of 3244	4272	RdpSaProxy.exe	88

C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper.exe
"C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3300

C:\Windows\system32\RdpSaProxy.exe
C:\Windows\system32\RdpSaProxy.exe -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\system32\RdpSa.exe
  "C:\Windows\system32\RdpSa.exe"
  2⤵
  PID:3244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads