932bcf6c68e34fb99ffafb5ae62a1473fe761d961034cb5630dc3a9ba9155ccb

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RDPW_Installer.exe
Size 2.4MB
Sample260729-pptpssvanf
SHA256 932bcf6c68e34fb99ffafb5ae62a1473fe761d961034cb5630dc3a9ba9155ccb
MD5 6ebea4d46302623d47827cd82e0aa4b3
SHA1 51c8d2af8a8f00da1eab9ce34a9f9505115295de
SHA512 5c37af879652aee3f18be92732c0bf52ac8b7e6aaded5a7f31303e5f0eef0fea75a4a779a436dbb06960af390bcc5722cac3fa7db3cd283fa80ce499af94700d
SSDEEP 49152:7QT501gtKhLiL4uvT4pHmaBfxoxokdwsCIG0nUCqIOQvVLJg5Hugq:7fZ8aHNBfLRIRUwOQtLJ1gq
TLSH
T178C52302AED0EE79D38139704099E635696D2C38CF2F78F7ABDE3E57B4343585825294
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2152	netsh.exe
3948	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	RDPWInst.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	RDP_CnC.exe

Executes dropped EXE 18 IoCs

pid	Process
1800	RDPWInst.exe
4360	RDPWInst.exe
3696	LGPO.exe
2172	RDP_CnC.exe
1576	RDPWInst.exe
2880	RDP_CnC.exe
2688	RDP_CnC.exe
5004	RDP_CnC.exe
3376	RDP_CnC.exe
1852	RDP_CnC.exe
1572	RDP_CnC.exe
4336	RDP_CnC.exe
224	RDP_CnC.exe
628	RDP_CnC.exe
3336	RDP_CnC.exe
760	RDP_CnC.exe
2728	RDP_CnC.exe
4100	RDP_CnC.exe

Loads dropped DLL 15 IoCs

pid	Process
1852	svchost.exe
4264	svchost.exe
4316	svchost.exe
2772	svchost.exe
1056	svchost.exe
3636	svchost.exe
4596	svchost.exe
3920	svchost.exe
4444	svchost.exe
4028	svchost.exe
1056	svchost.exe
1672	svchost.exe
3764	svchost.exe
2340	svchost.exe
4580	svchost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
9	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	RDPWInst.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	RDPWInst.exe
File opened for modification	C:\Windows\System32\GroupPolicy	LGPO.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	LGPO.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	LGPO.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	LGPO.exe
File created	C:\Windows\System32\GroupPolicy\User\Registry.pol	LGPO.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\RDP Wrapper\RDP_CnC.exe	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper\RDP_CnC.exe	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper\502F.tmp	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper\update.bat	xcopy.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	RDPWInst.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	RDPWInst.exe
File opened for modification	C:\Program Files\RDP Wrapper	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper	xcopy.exe
File created	C:\Program Files\RDP Wrapper\RDPWInst.exe	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper\RDPWInst.exe	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper\502F.tmp	xcopy.exe
File created	C:\Program Files\RDP Wrapper\update.bat	xcopy.exe
File opened for modification	C:\Program Files\RDP Wrapper\502F.tmp	xcopy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4752	cmd.exe
2076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDPW_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDPWInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDPWInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDPWInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LGPO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDP_CnC.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3068	PING.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3068	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4252	schtasks.exe

Suspicious behavior: EnumeratesProcesses 60 IoCs

pid	Process
1852	svchost.exe
1852	svchost.exe
1852	svchost.exe
1852	svchost.exe
4264	svchost.exe
4264	svchost.exe
4264	svchost.exe
4264	svchost.exe
4316	svchost.exe
4316	svchost.exe
4316	svchost.exe
4316	svchost.exe
2772	svchost.exe
2772	svchost.exe
2772	svchost.exe
2772	svchost.exe
1056	svchost.exe
1056	svchost.exe
1056	svchost.exe
1056	svchost.exe
3636	svchost.exe
3636	svchost.exe
3636	svchost.exe
3636	svchost.exe
4596	svchost.exe
4596	svchost.exe
4596	svchost.exe
4596	svchost.exe
3920	svchost.exe
3920	svchost.exe
3920	svchost.exe
3920	svchost.exe
4444	svchost.exe
4444	svchost.exe
4444	svchost.exe
4444	svchost.exe
4028	svchost.exe
4028	svchost.exe
4028	svchost.exe
4028	svchost.exe
1056	svchost.exe
1056	svchost.exe
1056	svchost.exe
1056	svchost.exe
1672	svchost.exe
1672	svchost.exe
1672	svchost.exe
1672	svchost.exe
3764	svchost.exe
3764	svchost.exe
3764	svchost.exe
3764	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
2340	svchost.exe
4580	svchost.exe
4580	svchost.exe
4580	svchost.exe
4580	svchost.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	RDPWInst.exe
Token: SeAuditPrivilege	1852	svchost.exe
Token: SeAuditPrivilege	4264	svchost.exe
Token: SeAuditPrivilege	4316	svchost.exe
Token: SeAuditPrivilege	2772	svchost.exe
Token: SeAuditPrivilege	1056	svchost.exe
Token: SeAuditPrivilege	3636	svchost.exe
Token: SeAuditPrivilege	4596	svchost.exe
Token: SeAuditPrivilege	3920	svchost.exe
Token: SeAuditPrivilege	4444	svchost.exe
Token: SeAuditPrivilege	4028	svchost.exe
Token: SeAuditPrivilege	1056	svchost.exe
Token: SeAuditPrivilege	1672	svchost.exe
Token: SeAuditPrivilege	3764	svchost.exe
Token: SeAuditPrivilege	2340	svchost.exe
Token: SeAuditPrivilege	4580	svchost.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
2172	RDP_CnC.exe
2880	RDP_CnC.exe
2688	RDP_CnC.exe
5004	RDP_CnC.exe
3376	RDP_CnC.exe
1852	RDP_CnC.exe
1572	RDP_CnC.exe
4336	RDP_CnC.exe
224	RDP_CnC.exe
628	RDP_CnC.exe
3336	RDP_CnC.exe
760	RDP_CnC.exe
2728	RDP_CnC.exe
4100	RDP_CnC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4752	4064	RDPW_Installer.exe	87
PID 4752 wrote to memory of 1800	4752	cmd.exe	88
PID 4752 wrote to memory of 3068	4752	cmd.exe	89
PID 4752 wrote to memory of 2984	4752	cmd.exe	90
PID 4752 wrote to memory of 4576	4752	cmd.exe	91
PID 4752 wrote to memory of 4080	4752	cmd.exe	92
PID 4752 wrote to memory of 5096	4752	cmd.exe	93
PID 4752 wrote to memory of 4360	4752	cmd.exe	94
PID 4360 wrote to memory of 2152	4360	RDPWInst.exe	111
PID 4360 wrote to memory of 3948	4360	RDPWInst.exe	112
PID 4752 wrote to memory of 3696	4752	cmd.exe	113
PID 4752 wrote to memory of 4252	4752	cmd.exe	114
PID 4752 wrote to memory of 2076	4752	cmd.exe	115
PID 2076 wrote to memory of 2172	2076	cmd.exe	116
PID 2172 wrote to memory of 1388	2172	RDP_CnC.exe	122
PID 1388 wrote to memory of 3936	1388	net.exe	124
PID 2172 wrote to memory of 4552	2172	RDP_CnC.exe	125
PID 4552 wrote to memory of 4496	4552	net.exe	127
PID 2172 wrote to memory of 2880	2172	RDP_CnC.exe	129
PID 2880 wrote to memory of 3136	2880	RDP_CnC.exe	130
PID 3136 wrote to memory of 4536	3136	net.exe	132
PID 2880 wrote to memory of 1264	2880	RDP_CnC.exe	134
PID 1264 wrote to memory of 3440	1264	net.exe	136
PID 2880 wrote to memory of 2688	2880	RDP_CnC.exe	137
PID 2688 wrote to memory of 3104	2688	RDP_CnC.exe	139
PID 3104 wrote to memory of 2160	3104	net.exe	141
PID 2688 wrote to memory of 4488	2688	RDP_CnC.exe	143
PID 4488 wrote to memory of 4580	4488	net.exe	145
PID 2688 wrote to memory of 5004	2688	RDP_CnC.exe	146
PID 5004 wrote to memory of 384	5004	RDP_CnC.exe	147
PID 384 wrote to memory of 1436	384	net.exe	149
PID 5004 wrote to memory of 2684	5004	RDP_CnC.exe	151
PID 2684 wrote to memory of 4252	2684	net.exe	153
PID 5004 wrote to memory of 3376	5004	RDP_CnC.exe	154
PID 3376 wrote to memory of 1504	3376	RDP_CnC.exe	155
PID 1504 wrote to memory of 4060	1504	net.exe	157
PID 3376 wrote to memory of 3484	3376	RDP_CnC.exe	159
PID 3484 wrote to memory of 3336	3484	net.exe	161
PID 3376 wrote to memory of 1852	3376	RDP_CnC.exe	162
PID 1852 wrote to memory of 2388	1852	RDP_CnC.exe	163
PID 2388 wrote to memory of 4128	2388	net.exe	165
PID 1852 wrote to memory of 4484	1852	RDP_CnC.exe	167
PID 4484 wrote to memory of 4568	4484	net.exe	169
PID 1852 wrote to memory of 1572	1852	RDP_CnC.exe	170
PID 1572 wrote to memory of 2976	1572	RDP_CnC.exe	171
PID 2976 wrote to memory of 3512	2976	net.exe	173
PID 1572 wrote to memory of 568	1572	RDP_CnC.exe	175
PID 568 wrote to memory of 4536	568	net.exe	177
PID 1572 wrote to memory of 4336	1572	RDP_CnC.exe	178
PID 4336 wrote to memory of 4524	4336	RDP_CnC.exe	179
PID 4524 wrote to memory of 1048	4524	net.exe	181
PID 4336 wrote to memory of 464	4336	RDP_CnC.exe	183
PID 464 wrote to memory of 2400	464	net.exe	185
PID 4336 wrote to memory of 224	4336	RDP_CnC.exe	186
PID 224 wrote to memory of 1168	224	RDP_CnC.exe	187
PID 1168 wrote to memory of 2988	1168	net.exe	189
PID 224 wrote to memory of 3444	224	RDP_CnC.exe	191
PID 3444 wrote to memory of 2468	3444	net.exe	193
PID 224 wrote to memory of 628	224	RDP_CnC.exe	194
PID 628 wrote to memory of 2820	628	RDP_CnC.exe	195
PID 2820 wrote to memory of 3384	2820	net.exe	197
PID 628 wrote to memory of 2132	628	RDP_CnC.exe	199
PID 2132 wrote to memory of 3500	2132	net.exe	201
PID 628 wrote to memory of 3336	628	RDP_CnC.exe	202

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RDPW_Installer.exe
"C:\Users\Admin\AppData\Local\Temp\RDPW_Installer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\502E.tmp\502F.tmp\5030.bat C:\Users\Admin\AppData\Local\Temp\RDPW_Installer.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Users\Admin\AppData\Local\Temp\502E.tmp\RDPWInst.exe
    "RDPWInst" -u
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1800
- - C:\Windows\system32\PING.EXE
    ping -n 3 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3068
- - C:\Windows\system32\xcopy.exe
    xcopy "RDP_CnC.exe" "C:\Program Files\RDP Wrapper\" /s /I /y
    3⤵
    - Drops file in Program Files directory
    PID:2984
- - C:\Windows\system32\xcopy.exe
    xcopy "RDPWInst.exe" "C:\Program Files\RDP Wrapper\" /s /I /y
    3⤵
    - Drops file in Program Files directory
    PID:4576
- - C:\Windows\system32\xcopy.exe
    xcopy "update.bat" "C:\Program Files\RDP Wrapper\" /s /I /y
    3⤵
    - Drops file in Program Files directory
    PID:4080
- - C:\Windows\system32\xcopy.exe
    xcopy "RDP_CnC.lnk" "C:\Users\Admin\Desktop\" /s /I /y
    3⤵
    PID:5096
- - C:\Program Files\RDP Wrapper\RDPWInst.exe
    "C:\Program Files\RDP Wrapper\RDPWInst" -i -o
    3⤵
    - Server Software Component: Terminal Services DLL
    - Executes dropped EXE
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2152
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=udp localport=3389 profile=any action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3948
- - C:\Users\Admin\AppData\Local\Temp\502E.tmp\LGPO.exe
    lgpo /m H264_ON.pol
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:3696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /CREATE /SC ONSTART /DELAY 0002:00 /TN "RDPWUpdater" /TR "'C:\Program Files\RDP Wrapper\RDPWInst.exe' -w" /RL HIGHEST /RU SYSTEM /NP /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4252
- - C:\Windows\system32\cmd.exe
    cmd.exe /C start "" "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2076
  - - C:\Program Files\RDP Wrapper\RDP_CnC.exe
      "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2172
    - - C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1388
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        6⤵
        
        PID:3936
    - - C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4552
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        6⤵
        
        PID:4496
    - - C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2880
      - C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        7⤵
        
        PID:4536
      - C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        7⤵
        
        PID:3440
      - C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        8⤵
        
        PID:2160
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        8⤵
        
        PID:4580
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        9⤵
        
        PID:1436
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        9⤵
        
        PID:4252
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        10⤵
        
        PID:4060
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        10⤵
        
        PID:3336
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        11⤵
        
        PID:4128
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        11⤵
        
        PID:4568
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        12⤵
        
        PID:3512
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:568
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        12⤵
        
        PID:4536
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        13⤵
        
        PID:1048
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        13⤵
        
        PID:2400
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        14⤵
        
        PID:2988
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        14⤵
        
        PID:2468
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        15⤵
        
        PID:3384
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        15⤵
        
        PID:3500
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3336
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        15⤵
        
        PID:4080
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        16⤵
        
        PID:2256
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        15⤵
        
        PID:316
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        16⤵
        
        PID:2804
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:760
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        16⤵
        
        PID:3300
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        17⤵
        
        PID:4496
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        16⤵
        
        PID:4888
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        17⤵
        
        PID:1988
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2728
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        17⤵
        
        PID:4956
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        18⤵
        
        PID:1104
        
        C:\Windows\SYSTEM32\net.exe
        
        net start termservice /y
        17⤵
        
        PID:3968
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start termservice /y
        18⤵
        
        PID:3288
        
        C:\Program Files\RDP Wrapper\RDP_CnC.exe
        
        "C:\Program Files\RDP Wrapper\RDP_CnC.exe"
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4100
        
        C:\Windows\SYSTEM32\net.exe
        
        net stop termservice /y
        18⤵
        
        PID:64
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 stop termservice /y
        19⤵
        
        PID:4856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:3160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1568

C:\Program Files\RDP Wrapper\RDPWInst.exe
"C:\Program Files\RDP Wrapper\RDPWInst.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update.bat

Path C:\Program Files\RDP Wrapper\update.bat
Size 322B
SHA256 ab0cf42c898e0fcff6332094226312901d6afe2eab5598cf7eaccdaaea6ea3d9
MD5 8f9a5bf6d5331c46c8d9bc63700077fc
SHA1 4fa07a1599d5ae06416ab9004eca85511f534094
SHA512 9c9d66f85c46ae532e58b724deddf01394df68fa7194355b4c8e92d7a6f4652fec38bbaaead669823f0dc2c3bc06fcc35e12e58affa9d306e2076a277064f35e
TLSH
T1CCE07D0D5667A27BA4E03D548B996D12F00F015B56170BBD7EB1053DEE9C0C8A0DEDD3
MD5 SHA1 SHA512 TLSH

Submit Download

5030.bat

Path C:\Users\Admin\AppData\Local\Temp\502E.tmp\502F.tmp\5030.bat
Size 824B
SHA256 bf7f1043f7d151e06440c07aa91bd2c7048657515c12a0af8dea2becfe6802bd
MD5 1c04db7c0404d977651e89247b449fb5
SHA1 0de81ba7099f77efa9d387a4e334fdcc4f1cde5f
SHA512 0e8c6c0edb187ec58f8447779f3f60189b59b35100eec530befa83705fdc32933dcd572e2d31bedd9b3546b63147af48b4437802a5f69d63d606d560ae5c6b2c
TLSH
T1A501AF0C98A5F6B075423D5843483D1491069C1A228612FD3FDC075FEAEA6D8C2DE2D2
MD5 SHA1 SHA512 TLSH

Submit Download

H264_ON.pol

Path C:\Users\Admin\AppData\Local\Temp\502E.tmp\H264_ON.pol
Size 186B
SHA256 213da1274863316dbf91aa4c725b86f23e37784912930ed951003608834a0b46
MD5 78952b476aa2e47bf0e27416acf6fe1f
SHA1 5543f22fe65fa4193008163107acd4ef8fbb338b
SHA512 5d4a1e4f13f01530ecfa399ac7e6db74403d4c1b3eed23f4fb0f068a387fde42d5651fadfbb9aad6a28c5a40345b70fb13c1e9210123157711622d9aab8fc21d
TLSH
T1ABC04C1143F41A56FAF56A71557329092C7B75565916851E0158810F0DB5EA4CF33327
MD5 SHA1 SHA512 TLSH

Submit Download

LGPO.exe

Path C:\Users\Admin\AppData\Local\Temp\502E.tmp\LGPO.exe
Size 469KB
SHA256 0c97f29543418b30340c4ff5d930d31e6196dd59c2cc74b6b890fa7b90c910c7
MD5 fdf6c1f114a0fd2a144a6a126206461c
SHA1 bacfef8c102b1791ebe3229324cdf75da3171952
SHA512 9d941f1bb73c999f7f3c54f20a673fc4bc0342ba1d5c43e271e70f67294a63253878f8ab412e5b6ec39468e556c37dadeff0c167b22dd1bb675eca93d4e2cbce
SSDEEP 12288:km/Mfnx1+keV2XxPZ5OFV6h7+RHO8kyRpCX4DZVqFHdUk5xS8j0:KZEm+d2X4NVqc0xS8Y
TLSH
T1A6A47C1076A6C036E0F242301E79EF66557EB8254F7059CFB3D85A2E5A712C26A31F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDPWInst.exe

Path C:\Users\Admin\AppData\Local\Temp\502E.tmp\RDPWInst.exe
Size 2.3MB
SHA256 d8b3001c86a1433524f1239c2a14a11d67009bba44dc3c686f295bcc0facc5a1
MD5 980d56ae0a529ba108d9194fb056f285
SHA1 d58d987989d1f44effb4bb29d06efb1c51f66718
SHA512 3852e5e8785a383717500b37b1f2a0a94cd3178b1d17bbebb9389ab230f93feccec7bdf6b14230230c84b485d163bfad464d89dcd8bc14a1cc28f9fc22ad90e7
SSDEEP 24576:jonfYwnqZ2tZ4DImIiXw2+6WiaTAsN/3ebTvK+63CWH8iA/iD2hgPjcC8SVdKZmQ:XGmIi0pdqYH8ia6GcKZ37
TLSH
T1A0B56D15F2C8523ED45BD2359A325361E7BAB9442B209F8B39B40E4DDF2B2C02F36759
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_CnC.exe

Path C:\Users\Admin\AppData\Local\Temp\502E.tmp\RDP_CnC.exe
Size 2.9MB
SHA256 5552c5ab33a144f420f1f1855392bd216c31385b4470b807f65017b310490c0e
MD5 08ed5177c4aa58aecb690243a7c60513
SHA1 eb4dda99c2201a2edcd4f2aee318f3775020da28
SHA512 32f713914b4d6514f9a33deed1d0cb34f521edd92d5868e8b3147e93f74dcb1e7264a54ecccd1c6ed27e870626a431581c4a6327c30df75369dde1b4d92323f9
SSDEEP 49152:w508rC2BkGRsj076sxNDlSkCtLyBCvDb3hU0Y+HLTU23tkjWdpX:w508rvBp2FyODb360Y+Mm8W
TLSH
T1E4E56D177A44787EC06A26366437D754993FEA70AA6BAC6717F40C8C8F357402E3E60B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RDP_CnC.lnk

Path C:\Users\Admin\AppData\Local\Temp\502E.tmp\RDP_CnC.lnk
Size 1KB
SHA256 83f134b45e9e28abd1e4a773f48c0303bc5f8b8b22f7fc12ee4fcb4011a7733d
MD5 bf5e6e967e6df74051e971d62ee9d282
SHA1 bcf85f18168b3b1e52d6f373afd8a3f81b6a7980
SHA512 6715f19c42555d25fc8e8eedf162ef2a7875f08a142251f58ddccc6df62b0b10cd33f397e8ab10b0eb0bb69d08ea4ec285b9bdd422121ee472d10bc3e42e165f
TLSH
T14431C21637DD2626E277E2B517B56501832BFC40B3921A3E808583C52CB15356169FAB
MD5 SHA1 SHA512 TLSH

Submit Download

rdpwrap.dll

Path \??\c:\program files\rdp wrapper\rdpwrap.dll
Size 114KB
SHA256 75fb4394ef5b8d1e7c74dfc61424101582ecdc406060caa9d66adea2ac8b37f8
MD5 0c2180b8e8cf57d168b0e5f388f90650
SHA1 dc6ba17b27e6611489c5c52f8956bc5a45001ecd
SHA512 8effc36cd55e0543219afa3df0d42e346ab8a6c67737977c24b4207281f490daf8f628614a745c26e6ef9f033a899c62378c99a8745e16c3e7935863c8f925ae
SSDEEP 3072:F3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVx:xMjTiVw2ve9LBMMpJsT
TLSH
T1F2B35B4773A100BBD4A7D638CDA34A52D7BA784656B1AB4F5790018A9F237E09E3CF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rdpwrap.ini

Path \??\c:\program files\rdp wrapper\rdpwrap.ini
Size 340KB
SHA256 d5458b7ecbc9d6cbc44ac6f076875d00a0af35a4a43ae7f340e00877cdfa371d
MD5 302369b32db541ef6603e29813b53b18
SHA1 2cfd1c400e98976c3cf3378716dbb30b2a9a3986
SHA512 e892a82a08a9b5c38079bf2aa623bfe73aa4a6a0d567282972290d572851a31b1df918e0c116362dcf261245310082a183eb922ccc7e408f2b7e02e737832109
SSDEEP 768:zUiQVQpXQq4WDi9SUnpB8fbQnxJcy8RMFdKKb8x8Rr/d6gl/+f8jZ0ftlFi4P7Qb:f3f33L+MOIiG4IvREWddadl/FCy
TLSH
T14D74AD58F4C95B7F5C0BE176FA3147B6E3F96D4CAA503300BD3C1B6A6B8A2442B2561C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/224-97-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/628-100-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/760-106-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/1572-91-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/1576-69-0x0000000000400000-0x000000000065A000-memory.dmp

Download

memory/1800-18-0x0000000000400000-0x000000000065A000-memory.dmp

Download

memory/1852-88-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/2172-73-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/2688-79-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/2728-109-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/2880-76-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/3336-103-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/3376-85-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/4064-0-0x0000000000417000-0x0000000000418000-memory.dmp

Download

memory/4336-94-0x0000000000400000-0x0000000000709000-memory.dmp

Download

memory/4360-37-0x0000000000400000-0x000000000065A000-memory.dmp

Download

memory/4360-51-0x0000000000400000-0x000000000065A000-memory.dmp

Download

memory/5004-82-0x0000000000400000-0x0000000000709000-memory.dmp

Download