Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 05:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DingTalkD_Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
DingTalkD_Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target DingTalkD_Setup.exe
- Size 5.8MB
- Sample260724-ftgrcssfnh
- SHA256 cb8e4d9dc39ecddc58f6eba2b60ffda80fad7119aad0ea2d7f2501573471ad4f
- MD5 c60770cfcdfb538b3b3eea24666fb92f
- SHA1 83e70b8d7ff57509790eddc4510aadd9fbd3a8c1
- SHA512 2544459f22e99fb84e2f3e9105f7883309c503907285331883ae37cdd625788a2973fbf3e4f26fdee0e8cb3f0d1f8eec7544d7e78f41f4778da5873283eb3254
- SSDEEP 98304:WzclJ5CYn/KCjhRzHeeMzngRmKa5jjN00DE6BuYHeaQ77hbrgkUtMfzfIIo2X:WkJriCjzrevzpjO0DE6BVHpQX5PNbfIe
- TLSH T14F5633474D88C538CAB4BF7B516334BA348B5D2CD2A93223F5C472983979A7C963B493
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" rdclient.exe - Deletes itself 1 IoCs
pid Process 2592 WScript.exe - Executes dropped EXE 3 IoCs
pid Process 4632 rdService.exe 3116 rdService.exe 1244 rdclient.exe - Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E4160FB650E5091C535216313A4ECD3_C47ED8EE7F5A9F96A4CA5A4E077920F9 rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4 rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4 rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E4160FB650E5091C535216313A4ECD3_C47ED8EE7F5A9F96A4CA5A4E077920F9 rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A96CC62C00FEA3DDB8AB25852385FFA rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A96CC62C00FEA3DDB8AB25852385FFA rdclient.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 2592 WScript.exe -
resource yara_rule behavioral2/memory/696-2-0x0000000010000000-0x00000000100BE000-memory.dmp upx behavioral2/memory/696-5-0x0000000010000000-0x00000000100BE000-memory.dmp upx behavioral2/memory/696-4-0x0000000010000000-0x00000000100BE000-memory.dmp upx behavioral2/memory/696-7-0x0000000010000000-0x00000000100BE000-memory.dmp upx behavioral2/memory/696-12-0x0000000010000000-0x00000000100BE000-memory.dmp upx behavioral2/memory/696-18-0x0000000010000000-0x00000000100BE000-memory.dmp upx behavioral2/memory/696-20-0x0000000010000000-0x00000000100BE000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DingTalkD_Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe - Modifies data under HKEY_USERS 49 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs rdclient.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings DingTalkD_Setup.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 696 DingTalkD_Setup.exe 696 DingTalkD_Setup.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 3116 rdService.exe 3116 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 1244 rdclient.exe 1244 rdclient.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe 4632 rdService.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4632 rdService.exe Token: SeDebugPrivilege 4632 rdService.exe Token: SeDebugPrivilege 3116 rdService.exe Token: SeDebugPrivilege 1244 rdclient.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 696 DingTalkD_Setup.exe 696 DingTalkD_Setup.exe 1244 rdclient.exe 1244 rdclient.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4632 wrote to memory of 1244 4632 rdService.exe 93 PID 696 wrote to memory of 2592 696 DingTalkD_Setup.exe 94 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System rdclient.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" rdclient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DingTalkD_Setup.exe"C:\Users\Admin\AppData\Local\Temp\DingTalkD_Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"2⤵
- Deletes itself
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
PID:2592
-
-
C:\Users\Admin\AppData\Roaming\qVjnPTiR\rdpro\rdService.exeC:\Users\Admin\AppData\Roaming\qVjnPTiR\rdpro\rdService.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116
-
C:\Users\Admin\AppData\Roaming\qVjnPTiR\rdpro\rdService.exeC:\Users\Admin\AppData\Roaming\qVjnPTiR\rdpro\rdService.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Roaming\qVjnPTiR\rdpro\rdclient.exeC:\Users\Admin\AppData\Roaming\qVjnPTiR\rdpro\rdclient.exe quiet2⤵
- UAC bypass
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1244
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\45da5d1264a7f4539e2d0e5b8f9267c5_0808cc13-ea9c-46c7-97d8-0cc437b49958
- Size 50B
- SHA256 310296c01b935da93c667578c0114ac7e00cab70580f1fb50c34e5d7973bc076
- MD5 c0047cfb89d9a18c30b72bfe915fe2b3
- SHA1 421cee2f2b067661eb279ff23cee4656e6ceae88
- SHA512 c0ec501eaf87577ad168f7dd97af172ed09a1d0a87eb117aed6a07a62ba9fc9837e2be20f28e5e87878192e2f89540e84ca59921aa3c5c48b37726ec733a7e53
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\tem.vbs
- Size 226B
- SHA256 d985ac57cd1419fb57a2ea89c865fd37a85cd72ca61caed521ea3e0a38249e75
- MD5 3d37a6393efbb37d2d36bc6e14505f75
- SHA1 613835913d7c22d5a93f5ac8a3d3af631d405e84
- SHA512 e3308ab00692192e485e057e4642a856f94b88f24c761eee492397ff44f2707746c2ff297f3116dd02a0613ee354138150f14c85ed8754a3ccdf0c665e5b4d46
- TLSH T178D0A7619F83D52D041755434877890EF06418186F50BB14A680D9C86B83729BA9B386
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\qVjnPTiR\rdpro\cfg.ini
- Size 100B
- SHA256 9a173e5b688f17ffc7c40c0f15f1f93eb95a369cd237e3fbe90db78dde22612e
- MD5 73efa12f645bbe61ba92e8a99e80c85a
- SHA1 bce49c9e21158e2d33b52ad1d9b261defc3b9a35
- SHA512 95c87b017047ea95b3b85265b569c29082ad1e0097433dab99e59bbf4013dea90bc22a547f32829ff427aef80b0a3022f35a218b9b51bea9bfb3393ecf0dab33
- TLSH T11DB012195D25F05344FC202D904BC8CC48C0FD149C2BD44049B454C6DF2C2F64897A18
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\qVjnPTiR\rdpro\cfg.ini
- Size 171B
- SHA256 c15502db3562f8c592900b96ecce6cee31e625818c959838a12a5d658183b39e
- MD5 e46b0155fc2acf66308df6049037e092
- SHA1 e736f2aa2764a8c857f754f4b0343f2ac12a02dc
- SHA512 33ef152ac823ad92b9f22e0afae56e5052ca749e6d29145bb9ab6ac120c3330e5c9bdc4446b00d3dd7fda8aad3f4b49ec1f72c34632ca573efb4998844caf0fa
- TLSH T17EC0C0167911F41245FC003CC02FAB9804D0BE048C3FD404079144C8C66C0F34881404
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\qVjnPTiR\rdpro\host.dat
- Size 130B
- SHA256 c59d5f3e2ab618ad80967a42a95b15012c9b303e4349720982e91662f00eb155
- MD5 861b29878cf65f91a603181560cb0801
- SHA1 402e025d252e3485d18efd850a506138cc9145b5
- SHA512 93388c94756c6b1034c74b748109c2056496e1b087e2eb7579c7de612c6c65ea2cce0558b777d5f5bfe81be04feb64f57037e248f9eb1b1644e96888e4eeff2a
- TLSH T1EAC02B48A070CD34C06A228444F2CC9104102D0C080006B705419213620D918004A029
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\qVjnPTiR\rdpro\rdService.exe
- Size 2.5MB
- SHA256 7ed2a077a1ce34fcb182e5135ae75ad7bd96207c3204c9f343095f967bfa109f
- MD5 db3d3a7f82f0c7afb258a98c50a66a36
- SHA1 8cc26bec161dc58472e848c427310ae396520f88
- SHA512 73b54dc39fbb512054168ad59acaf00b2177138091869f6df46a8fa24b98e977092617cc89d32cad5690f8e930715352003adde7d3a0ac9a1c9fcb942f62471e
- SSDEEP 24576:dEGJjsQPX8V/vLGUFAyzEVSg1F2+kkROf4pY7DH7cpFVBqSRg/lIhu/WST5V2tSw:Ts8Xi3LdFb0MR7uVASC/rWSrU3
- TLSH T127C55B23B2D9653ED06B173A5827B6145C3BB7A13A2A9C0797F4084C9F296C13E3B747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\qVjnPTiR\rdpro\rdclient.exe
- Size 13.9MB
- SHA256 5bea7f348d4ff47afb4abbb06909b894434d4df83318780da23bbe49bc0fb233
- MD5 122c481e44221fefd34c808ff679b1ba
- SHA1 d002ac7ca106776410881727705618c7e2a6e6f6
- SHA512 7f6d2ad71d0caa2cbcce915283fee74c56e38a75d04d989dfb4032edcbd763a88f663df7ecd021fa311dc67267c2a7a7c1cd9c9ed93a7e2b37729553bf428773
- SSDEEP 196608:adkzWu3D5fHvGDYXtAUEhry3idpjMUFd3mptq9:ayzW+D5fHuD6ghr5XgdpG
- TLSH T138E69E07B680A03BD4672A3A982BD3D0283BBE316A15CD573BB8BD4C6F356417D29747
- MD5 SHA1 SHA512 SSDEEP TLSH