cb8e4d9dc39ecddc58f6eba2b60ffda80fad7119aad0ea2d7f2501573471ad4f

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DingTalkD_Setup.exe
Size 5.8MB
Sample260724-ftgrcssfnh
SHA256 cb8e4d9dc39ecddc58f6eba2b60ffda80fad7119aad0ea2d7f2501573471ad4f
MD5 c60770cfcdfb538b3b3eea24666fb92f
SHA1 83e70b8d7ff57509790eddc4510aadd9fbd3a8c1
SHA512 2544459f22e99fb84e2f3e9105f7883309c503907285331883ae37cdd625788a2973fbf3e4f26fdee0e8cb3f0d1f8eec7544d7e78f41f4778da5873283eb3254
SSDEEP 98304:WzclJ5CYn/KCjhRzHeeMzngRmKa5jjN00DE6BuYHeaQ77hbrgkUtMfzfIIo2X:WkJriCjzrevzpjO0DE6BVHpQX5PNbfIe
TLSH
T14F5633474D88C538CAB4BF7B516334BA348B5D2CD2A93223F5C472983979A7C963B493
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution spyware trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	rdclient.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	DingTalkD_Setup.exe

Deletes itself 1 IoCs

pid	Process
3824	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2328	rdService.exe
4968	rdclient.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\538F535B7FBDE384E456CC9F5DA5FBAB	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\538F535B7FBDE384E456CC9F5DA5FBAB	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A96CC62C00FEA3DDB8AB25852385FFA	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A96CC62C00FEA3DDB8AB25852385FFA	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E4160FB650E5091C535216313A4ECD3_C47ED8EE7F5A9F96A4CA5A4E077920F9	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E4160FB650E5091C535216313A4ECD3_C47ED8EE7F5A9F96A4CA5A4E077920F9	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	rdclient.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3824	WScript.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2880-2-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral1/memory/2880-5-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral1/memory/2880-4-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral1/memory/2880-8-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral1/memory/2880-13-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral1/memory/2880-18-0x0000000010000000-0x00000000100BE000-memory.dmp	upx
behavioral1/memory/2880-20-0x0000000010000000-0x00000000100BE000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DingTalkD_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rdService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rdclient.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rdclient.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	DingTalkD_Setup.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3DD483E2BBF4C05E8AF10F5FA7626CFD3DC3092	rdclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3DD483E2BBF4C05E8AF10F5FA7626CFD3DC3092\Blob = 0400000001000000100000006d469ed9256d08235b5e747d1e27dbf20f00000001000000400000005cf58dc4429325fb69e9498383333acbf76eddfd5845bb9d29fdb935b2652c9184295565157a1d83335f9b67e3e2b67d6c01238ce81adecbf3d75e98b3e99d7953000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b0000000100000038000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410020003200000009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000b676f2eddae8775cd36cb0f63cd1d4603961f49e6265ba013a2f0307b6d0b804140000000100000014000000b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd1d000000010000001000000004321ccbc528a397f1620cb39dfc6d35030000000100000014000000d3dd483e2bbf4c05e8af10f5fa7626cfd3dc309219000000010000001000000015b8b4807e45c1ae49fa34daa40347e62000000001000000d6050000308205d2308203baa003020102021021d6d04a4f250fc93237fcaa5e128de9300d06092a864886f70d01010d0500308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b20434120323022180f32303131313030363038333935365a180f32303436313030363038333935365a308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100bdf978f8e6d5800c649d861b9664673f223a1e75017deffb5c678cc9cc5c6ba991e6b942e5204b9bda9b7bb9995dd99b804bd784402b27d3e8ba30bb3e091aa74995ef2b4024c297c7a7ee9b25efa80a0097855aaa9ddc29c9e23507eb704d4ad6c1b356b8a141389bd1fb317f8fe05fe1b13f0f8e164960d7068d18f9aa2610ab2ad3d0d1678d1b46be4730d52e72d1c563dae76379447e4b632489862e343f294c528b2aa7c0e2912889b9c05bf91dd9e727adff9a0297c1c650929b022cbda9b934590abf844affdffeb39febd99ee09823eca66b77162adbccad3b1ca487dc46735e1962684557e4908242bb42d6f061e0c1a33d66a35df418ee88c98d1745299932750231ee2926c86b02e6b562457f37155a236889d43ede4e27b0f0400cbc4d17cb4da2b31ed0065addf693cf577599f5fa861a6778b3bf96fe34dcbde75256e5b3e5757bd7419105dc5d69e3950d43b9fc839639957b6c805a4f1372c6d77d297a44ba52a42ad541460920fe22a0b65b308dbc890cd5d770f88752fddaefac512e07b34efed009da70ef98fa56e66ddbb5574bdce52c2515c89e2e784ef8da9c9e862cca57f31ae5c8928b1a82967ac3bc501269d80e5a468b3aeb26fa23c9b6b081be4200a4f8d6fe302ec7d246f6e58e75fdf2ccb9d0875bcc061060bb8335b75e67de47ec9948f1a4a115fead8c628e39554f3916b9b1639dffb70203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e04160414b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd300e0603551d0f0101ff040403020106300d06092a864886f70d01010d0500038202010071a50ecee4e9bf3f38d5895ac40261fb4cc514172d8b4f536b1017fc6584c7104990dedbc7269388266f70d6025e39a0f78fab96b5a5135c81146d0e8182111b8a4ec64fa5dd621e44df0959f45b770b37e98b20c6f80a4e2e581ceb33d0cf8660c9dafb802f9e4c6084783d2164d6fb411f180fe7c97571bdbd5cde34873e41b00ef6b9d63f091396142fde9a1d5ab956ce353ab05f704d5ee329f123287259b6abc28c66261c772c2676358b28a769a0f93bf523dd851074c990035691e7afba47d412971122e3a249946ce7b7944bba2da4da338b4ca644ff5a3cc61d64d8b531e4a63c7aa8570bdbed611acbf1ce737763a4876f4c5138d6e45fc79fb6812ae4854879585e3bf8db028267c139dbc3744b3d361ef9299388685ba8441921f0a7e8810d2ce89336b437b2cab01b267a9a251f9a9a809e4b2a3ffba39afe733271c29ec672e18a6827f1e40fb4c44ca56193f89710072a3025a9b9c871b8ef68cc2d7ef5e07e0f82a86fb6ba6c834377cd8a9217a19e5b78163d45e23372dde166ca99d3c9c526fd0d680446aeb6d99b8cbe19beb1c6f219e35c02ca2cd86f4a07d9c935da4075f2c4a7196f9e42109875e6958b60bcedc512d78aced5985c569603c5ee770635ffcfe4ee3f1361eedbda2d85f0cdae9db2180945c392a17217fc47b6a00b2cf1c4de4368086a5f3bf07663fbcc062ca6c6e20eb5b9be248f	rdclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3DD483E2BBF4C05E8AF10F5FA7626CFD3DC3092\Blob = 5c00000001000000040000000010000019000000010000001000000015b8b4807e45c1ae49fa34daa40347e6030000000100000014000000d3dd483e2bbf4c05e8af10f5fa7626cfd3dc30921d000000010000001000000004321ccbc528a397f1620cb39dfc6d35140000000100000014000000b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd620000000100000020000000b676f2eddae8775cd36cb0f63cd1d4603961f49e6265ba013a2f0307b6d0b80409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010b0000000100000038000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410020003200000053000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000400000005cf58dc4429325fb69e9498383333acbf76eddfd5845bb9d29fdb935b2652c9184295565157a1d83335f9b67e3e2b67d6c01238ce81adecbf3d75e98b3e99d790400000001000000100000006d469ed9256d08235b5e747d1e27dbf22000000001000000d6050000308205d2308203baa003020102021021d6d04a4f250fc93237fcaa5e128de9300d06092a864886f70d01010d0500308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b20434120323022180f32303131313030363038333935365a180f32303436313030363038333935365a308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100bdf978f8e6d5800c649d861b9664673f223a1e75017deffb5c678cc9cc5c6ba991e6b942e5204b9bda9b7bb9995dd99b804bd784402b27d3e8ba30bb3e091aa74995ef2b4024c297c7a7ee9b25efa80a0097855aaa9ddc29c9e23507eb704d4ad6c1b356b8a141389bd1fb317f8fe05fe1b13f0f8e164960d7068d18f9aa2610ab2ad3d0d1678d1b46be4730d52e72d1c563dae76379447e4b632489862e343f294c528b2aa7c0e2912889b9c05bf91dd9e727adff9a0297c1c650929b022cbda9b934590abf844affdffeb39febd99ee09823eca66b77162adbccad3b1ca487dc46735e1962684557e4908242bb42d6f061e0c1a33d66a35df418ee88c98d1745299932750231ee2926c86b02e6b562457f37155a236889d43ede4e27b0f0400cbc4d17cb4da2b31ed0065addf693cf577599f5fa861a6778b3bf96fe34dcbde75256e5b3e5757bd7419105dc5d69e3950d43b9fc839639957b6c805a4f1372c6d77d297a44ba52a42ad541460920fe22a0b65b308dbc890cd5d770f88752fddaefac512e07b34efed009da70ef98fa56e66ddbb5574bdce52c2515c89e2e784ef8da9c9e862cca57f31ae5c8928b1a82967ac3bc501269d80e5a468b3aeb26fa23c9b6b081be4200a4f8d6fe302ec7d246f6e58e75fdf2ccb9d0875bcc061060bb8335b75e67de47ec9948f1a4a115fead8c628e39554f3916b9b1639dffb70203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e04160414b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd300e0603551d0f0101ff040403020106300d06092a864886f70d01010d0500038202010071a50ecee4e9bf3f38d5895ac40261fb4cc514172d8b4f536b1017fc6584c7104990dedbc7269388266f70d6025e39a0f78fab96b5a5135c81146d0e8182111b8a4ec64fa5dd621e44df0959f45b770b37e98b20c6f80a4e2e581ceb33d0cf8660c9dafb802f9e4c6084783d2164d6fb411f180fe7c97571bdbd5cde34873e41b00ef6b9d63f091396142fde9a1d5ab956ce353ab05f704d5ee329f123287259b6abc28c66261c772c2676358b28a769a0f93bf523dd851074c990035691e7afba47d412971122e3a249946ce7b7944bba2da4da338b4ca644ff5a3cc61d64d8b531e4a63c7aa8570bdbed611acbf1ce737763a4876f4c5138d6e45fc79fb6812ae4854879585e3bf8db028267c139dbc3744b3d361ef9299388685ba8441921f0a7e8810d2ce89336b437b2cab01b267a9a251f9a9a809e4b2a3ffba39afe733271c29ec672e18a6827f1e40fb4c44ca56193f89710072a3025a9b9c871b8ef68cc2d7ef5e07e0f82a86fb6ba6c834377cd8a9217a19e5b78163d45e23372dde166ca99d3c9c526fd0d680446aeb6d99b8cbe19beb1c6f219e35c02ca2cd86f4a07d9c935da4075f2c4a7196f9e42109875e6958b60bcedc512d78aced5985c569603c5ee770635ffcfe4ee3f1361eedbda2d85f0cdae9db2180945c392a17217fc47b6a00b2cf1c4de4368086a5f3bf07663fbcc062ca6c6e20eb5b9be248f	rdclient.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2880	DingTalkD_Setup.exe
2880	DingTalkD_Setup.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
4968	rdclient.exe
4968	rdclient.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe
2328	rdService.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	rdService.exe
Token: SeDebugPrivilege	2328	rdService.exe
Token: SeDebugPrivilege	4968	rdclient.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2880	DingTalkD_Setup.exe
2880	DingTalkD_Setup.exe
4968	rdclient.exe
4968	rdclient.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 4968	2328	rdService.exe	89
PID 2880 wrote to memory of 3824	2880	DingTalkD_Setup.exe	90

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	rdclient.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	rdclient.exe

C:\Users\Admin\AppData\Local\Temp\DingTalkD_Setup.exe
"C:\Users\Admin\AppData\Local\Temp\DingTalkD_Setup.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"
  2⤵
  - Deletes itself
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:3824

C:\Users\Admin\AppData\Roaming\lDvwVPKB\rdpro\rdService.exe
C:\Users\Admin\AppData\Roaming\lDvwVPKB\rdpro\rdService.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Users\Admin\AppData\Roaming\lDvwVPKB\rdpro\rdclient.exe
  C:\Users\Admin\AppData\Roaming\lDvwVPKB\rdpro\rdclient.exe quiet
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a7bdcf8802ebf9aef66d9a2622c19a47_5a83130d-ec86-4f37-a792-b9c75904b51b

Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\a7bdcf8802ebf9aef66d9a2622c19a47_5a83130d-ec86-4f37-a792-b9c75904b51b
Size 50B
SHA256 c782159543f26e985c9d8329a71f03af1582e376df47ed03bda8e177bfb8dd74
MD5 78199d2d3494dc11e07edd3192e72511
SHA1 8165c956cdb56907805dcef7a8998d7ca59efc8b
SHA512 2305fba4e3c3156dddc446e42a9135ed721923fd21885ba4044902e3b69efcd7b424ac9fd39cc4cd7cdc36277d27c898362dcbd787cb3864551c27be9ae0562a
MD5 SHA1 SHA512

Submit Download

tem.vbs

Path C:\Users\Admin\AppData\Local\Temp\tem.vbs
Size 226B
SHA256 d985ac57cd1419fb57a2ea89c865fd37a85cd72ca61caed521ea3e0a38249e75
MD5 3d37a6393efbb37d2d36bc6e14505f75
SHA1 613835913d7c22d5a93f5ac8a3d3af631d405e84
SHA512 e3308ab00692192e485e057e4642a856f94b88f24c761eee492397ff44f2707746c2ff297f3116dd02a0613ee354138150f14c85ed8754a3ccdf0c665e5b4d46
TLSH
T178D0A7619F83D52D041755434877890EF06418186F50BB14A680D9C86B83729BA9B386
MD5 SHA1 SHA512 TLSH

Submit Download

RdClient.exe

Path C:\Users\Admin\AppData\Roaming\lDvwVPKB\rdpro\RdClient.exe
Size 13.9MB
SHA256 5bea7f348d4ff47afb4abbb06909b894434d4df83318780da23bbe49bc0fb233
MD5 122c481e44221fefd34c808ff679b1ba
SHA1 d002ac7ca106776410881727705618c7e2a6e6f6
SHA512 7f6d2ad71d0caa2cbcce915283fee74c56e38a75d04d989dfb4032edcbd763a88f663df7ecd021fa311dc67267c2a7a7c1cd9c9ed93a7e2b37729553bf428773
SSDEEP 196608:adkzWu3D5fHvGDYXtAUEhry3idpjMUFd3mptq9:ayzW+D5fHuD6ghr5XgdpG
TLSH
T138E69E07B680A03BD4672A3A982BD3D0283BBE316A15CD573BB8BD4C6F356417D29747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfg.ini

Path C:\Users\Admin\AppData\Roaming\lDvwVPKB\rdpro\cfg.ini
Size 100B
SHA256 9a173e5b688f17ffc7c40c0f15f1f93eb95a369cd237e3fbe90db78dde22612e
MD5 73efa12f645bbe61ba92e8a99e80c85a
SHA1 bce49c9e21158e2d33b52ad1d9b261defc3b9a35
SHA512 95c87b017047ea95b3b85265b569c29082ad1e0097433dab99e59bbf4013dea90bc22a547f32829ff427aef80b0a3022f35a218b9b51bea9bfb3393ecf0dab33
TLSH
T11DB012195D25F05344FC202D904BC8CC48C0FD149C2BD44049B454C6DF2C2F64897A18
MD5 SHA1 SHA512 TLSH

Submit Download

cfg.ini

Path C:\Users\Admin\AppData\Roaming\lDvwVPKB\rdpro\cfg.ini
Size 171B
SHA256 af990e55631ebb319390fc1b39fbd561db4a3fb2b6d51c47b421958700c6788b
MD5 e66543ea973eb432d48a91757409bb8d
SHA1 9bfc581dfaa061d58f1ad0e9ce241b181868607d
SHA512 b266e475f51f38e336dbe968051afcf163fec1013debc0c9db32f5d4f2ab04631b1b61bac2e44839cc9c89a405f28fc347f5c4be46b2a6a1f8251ebe78fd708a
TLSH
T179C08C4A8E25F44A46F83C6F424B8C9E48E0FD455C2BA86589BC08C2CE2E2F30467E0C
MD5 SHA1 SHA512 TLSH

Submit Download

host.dat

Path C:\Users\Admin\AppData\Roaming\lDvwVPKB\rdpro\host.dat
Size 130B
SHA256 c59d5f3e2ab618ad80967a42a95b15012c9b303e4349720982e91662f00eb155
MD5 861b29878cf65f91a603181560cb0801
SHA1 402e025d252e3485d18efd850a506138cc9145b5
SHA512 93388c94756c6b1034c74b748109c2056496e1b087e2eb7579c7de612c6c65ea2cce0558b777d5f5bfe81be04feb64f57037e248f9eb1b1644e96888e4eeff2a
TLSH
T1EAC02B48A070CD34C06A228444F2CC9104102D0C080006B705419213620D918004A029
MD5 SHA1 SHA512 TLSH

Submit Download

rdService.exe

Path C:\Users\Admin\AppData\Roaming\lDvwVPKB\rdpro\rdService.exe
Size 2.5MB
SHA256 7ed2a077a1ce34fcb182e5135ae75ad7bd96207c3204c9f343095f967bfa109f
MD5 db3d3a7f82f0c7afb258a98c50a66a36
SHA1 8cc26bec161dc58472e848c427310ae396520f88
SHA512 73b54dc39fbb512054168ad59acaf00b2177138091869f6df46a8fa24b98e977092617cc89d32cad5690f8e930715352003adde7d3a0ac9a1c9fcb942f62471e
SSDEEP 24576:dEGJjsQPX8V/vLGUFAyzEVSg1F2+kkROf4pY7DH7cpFVBqSRg/lIhu/WST5V2tSw:Ts8Xi3LdFb0MR7uVASC/rWSrU3
TLSH
T127C55B23B2D9653ED06B173A5827B6145C3BB7A13A2A9C0797F4084C9F296C13E3B747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2328-63-0x0000000000FC0000-0x0000000001257000-memory.dmp

Download

memory/2328-64-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/2328-22-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/2880-20-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/2880-1-0x0000000000A58000-0x0000000000A59000-memory.dmp

Download

memory/2880-18-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/2880-13-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/2880-0-0x0000000000400000-0x0000000000A85000-memory.dmp

Download

memory/2880-8-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/2880-33-0x0000000000400000-0x0000000000A85000-memory.dmp

Download

memory/2880-4-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/2880-5-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/2880-6-0x0000000000400000-0x0000000000A85000-memory.dmp

Download

memory/2880-2-0x0000000010000000-0x00000000100BE000-memory.dmp

Download

memory/4968-88-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-90-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-29-0x0000000002200000-0x0000000002201000-memory.dmp

Download

memory/4968-77-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-79-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-81-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-65-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-83-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-66-0x0000000002200000-0x0000000002201000-memory.dmp

Download

memory/4968-85-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-92-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-94-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-96-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-98-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-100-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download

memory/4968-102-0x00000000008A0000-0x00000000017CB000-memory.dmp

Download