6a27a63285ae06e6d0004dc2ccefed9c0b4232fc0f419c95501b9e1f3d444e18

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
税務報告書.exe
Size 25.3MB
Sample260910-e6n6jafr7y
SHA256 6a27a63285ae06e6d0004dc2ccefed9c0b4232fc0f419c95501b9e1f3d444e18
MD5 05ea3e31e62042d5c9d886ec77c6f2e1
SHA1 42102cf8eb28bf5b1e1555a9a29a98ea9c6a18e3
SHA512 fc6d8250715fd53ab64ba542dfc5f6a56ef83cfeda9aa8b24751ced9c60853649c9785d31329c264b97433b471cb0dfcc73c1e141fc8fe9b3fa56038a28638a4
SSDEEP 393216:SQSNdWkNeM2YtcmSwhzCaOXDgACAuZLNZ8Qg1RaVNqjzWfRSlj1fJTgww4FYggRf:St5DtV/Cc9isVNqjqfRij1fpNjFYx
TLSH
T12C47337DA60057B8FA04C4BDE9334D14BB0D651EA5217CA24A0E64DA3363AFED5783BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution spyware trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	rdclient.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\538F535B7FBDE384E456CC9F5DA5FBAB	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E4160FB650E5091C535216313A4ECD3_A1607DA90539F9DA502DD0E00C008DE9	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E4160FB650E5091C535216313A4ECD3_A1607DA90539F9DA502DD0E00C008DE9	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\538F535B7FBDE384E456CC9F5DA5FBAB	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	rdclient.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	rdclient.exe

Executes dropped EXE 3 IoCs

pid	Process
4208	rdservice.exe
4472	rdclient.exe
1604	rdclient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5060	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rdclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rdclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	税務報告書.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rdservice.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5060	cmd.exe
872	PING.EXE

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	rdclient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	rdclient.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3DD483E2BBF4C05E8AF10F5FA7626CFD3DC3092	rdclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3DD483E2BBF4C05E8AF10F5FA7626CFD3DC3092\Blob = 0f00000001000000400000005cf58dc4429325fb69e9498383333acbf76eddfd5845bb9d29fdb935b2652c9184295565157a1d83335f9b67e3e2b67d6c01238ce81adecbf3d75e98b3e99d7953000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b0000000100000038000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410020003200000009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000b676f2eddae8775cd36cb0f63cd1d4603961f49e6265ba013a2f0307b6d0b804140000000100000014000000b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd1d000000010000001000000004321ccbc528a397f1620cb39dfc6d35030000000100000014000000d3dd483e2bbf4c05e8af10f5fa7626cfd3dc30922000000001000000d6050000308205d2308203baa003020102021021d6d04a4f250fc93237fcaa5e128de9300d06092a864886f70d01010d0500308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b20434120323022180f32303131313030363038333935365a180f32303436313030363038333935365a308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100bdf978f8e6d5800c649d861b9664673f223a1e75017deffb5c678cc9cc5c6ba991e6b942e5204b9bda9b7bb9995dd99b804bd784402b27d3e8ba30bb3e091aa74995ef2b4024c297c7a7ee9b25efa80a0097855aaa9ddc29c9e23507eb704d4ad6c1b356b8a141389bd1fb317f8fe05fe1b13f0f8e164960d7068d18f9aa2610ab2ad3d0d1678d1b46be4730d52e72d1c563dae76379447e4b632489862e343f294c528b2aa7c0e2912889b9c05bf91dd9e727adff9a0297c1c650929b022cbda9b934590abf844affdffeb39febd99ee09823eca66b77162adbccad3b1ca487dc46735e1962684557e4908242bb42d6f061e0c1a33d66a35df418ee88c98d1745299932750231ee2926c86b02e6b562457f37155a236889d43ede4e27b0f0400cbc4d17cb4da2b31ed0065addf693cf577599f5fa861a6778b3bf96fe34dcbde75256e5b3e5757bd7419105dc5d69e3950d43b9fc839639957b6c805a4f1372c6d77d297a44ba52a42ad541460920fe22a0b65b308dbc890cd5d770f88752fddaefac512e07b34efed009da70ef98fa56e66ddbb5574bdce52c2515c89e2e784ef8da9c9e862cca57f31ae5c8928b1a82967ac3bc501269d80e5a468b3aeb26fa23c9b6b081be4200a4f8d6fe302ec7d246f6e58e75fdf2ccb9d0875bcc061060bb8335b75e67de47ec9948f1a4a115fead8c628e39554f3916b9b1639dffb70203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e04160414b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd300e0603551d0f0101ff040403020106300d06092a864886f70d01010d0500038202010071a50ecee4e9bf3f38d5895ac40261fb4cc514172d8b4f536b1017fc6584c7104990dedbc7269388266f70d6025e39a0f78fab96b5a5135c81146d0e8182111b8a4ec64fa5dd621e44df0959f45b770b37e98b20c6f80a4e2e581ceb33d0cf8660c9dafb802f9e4c6084783d2164d6fb411f180fe7c97571bdbd5cde34873e41b00ef6b9d63f091396142fde9a1d5ab956ce353ab05f704d5ee329f123287259b6abc28c66261c772c2676358b28a769a0f93bf523dd851074c990035691e7afba47d412971122e3a249946ce7b7944bba2da4da338b4ca644ff5a3cc61d64d8b531e4a63c7aa8570bdbed611acbf1ce737763a4876f4c5138d6e45fc79fb6812ae4854879585e3bf8db028267c139dbc3744b3d361ef9299388685ba8441921f0a7e8810d2ce89336b437b2cab01b267a9a251f9a9a809e4b2a3ffba39afe733271c29ec672e18a6827f1e40fb4c44ca56193f89710072a3025a9b9c871b8ef68cc2d7ef5e07e0f82a86fb6ba6c834377cd8a9217a19e5b78163d45e23372dde166ca99d3c9c526fd0d680446aeb6d99b8cbe19beb1c6f219e35c02ca2cd86f4a07d9c935da4075f2c4a7196f9e42109875e6958b60bcedc512d78aced5985c569603c5ee770635ffcfe4ee3f1361eedbda2d85f0cdae9db2180945c392a17217fc47b6a00b2cf1c4de4368086a5f3bf07663fbcc062ca6c6e20eb5b9be248f	rdclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3DD483E2BBF4C05E8AF10F5FA7626CFD3DC3092\Blob = 19000000010000001000000015b8b4807e45c1ae49fa34daa40347e6030000000100000014000000d3dd483e2bbf4c05e8af10f5fa7626cfd3dc30921d000000010000001000000004321ccbc528a397f1620cb39dfc6d35140000000100000014000000b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd620000000100000020000000b676f2eddae8775cd36cb0f63cd1d4603961f49e6265ba013a2f0307b6d0b80409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010b0000000100000038000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410020003200000053000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000400000005cf58dc4429325fb69e9498383333acbf76eddfd5845bb9d29fdb935b2652c9184295565157a1d83335f9b67e3e2b67d6c01238ce81adecbf3d75e98b3e99d792000000001000000d6050000308205d2308203baa003020102021021d6d04a4f250fc93237fcaa5e128de9300d06092a864886f70d01010d0500308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b20434120323022180f32303131313030363038333935365a180f32303436313030363038333935365a308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100bdf978f8e6d5800c649d861b9664673f223a1e75017deffb5c678cc9cc5c6ba991e6b942e5204b9bda9b7bb9995dd99b804bd784402b27d3e8ba30bb3e091aa74995ef2b4024c297c7a7ee9b25efa80a0097855aaa9ddc29c9e23507eb704d4ad6c1b356b8a141389bd1fb317f8fe05fe1b13f0f8e164960d7068d18f9aa2610ab2ad3d0d1678d1b46be4730d52e72d1c563dae76379447e4b632489862e343f294c528b2aa7c0e2912889b9c05bf91dd9e727adff9a0297c1c650929b022cbda9b934590abf844affdffeb39febd99ee09823eca66b77162adbccad3b1ca487dc46735e1962684557e4908242bb42d6f061e0c1a33d66a35df418ee88c98d1745299932750231ee2926c86b02e6b562457f37155a236889d43ede4e27b0f0400cbc4d17cb4da2b31ed0065addf693cf577599f5fa861a6778b3bf96fe34dcbde75256e5b3e5757bd7419105dc5d69e3950d43b9fc839639957b6c805a4f1372c6d77d297a44ba52a42ad541460920fe22a0b65b308dbc890cd5d770f88752fddaefac512e07b34efed009da70ef98fa56e66ddbb5574bdce52c2515c89e2e784ef8da9c9e862cca57f31ae5c8928b1a82967ac3bc501269d80e5a468b3aeb26fa23c9b6b081be4200a4f8d6fe302ec7d246f6e58e75fdf2ccb9d0875bcc061060bb8335b75e67de47ec9948f1a4a115fead8c628e39554f3916b9b1639dffb70203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e04160414b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd300e0603551d0f0101ff040403020106300d06092a864886f70d01010d0500038202010071a50ecee4e9bf3f38d5895ac40261fb4cc514172d8b4f536b1017fc6584c7104990dedbc7269388266f70d6025e39a0f78fab96b5a5135c81146d0e8182111b8a4ec64fa5dd621e44df0959f45b770b37e98b20c6f80a4e2e581ceb33d0cf8660c9dafb802f9e4c6084783d2164d6fb411f180fe7c97571bdbd5cde34873e41b00ef6b9d63f091396142fde9a1d5ab956ce353ab05f704d5ee329f123287259b6abc28c66261c772c2676358b28a769a0f93bf523dd851074c990035691e7afba47d412971122e3a249946ce7b7944bba2da4da338b4ca644ff5a3cc61d64d8b531e4a63c7aa8570bdbed611acbf1ce737763a4876f4c5138d6e45fc79fb6812ae4854879585e3bf8db028267c139dbc3744b3d361ef9299388685ba8441921f0a7e8810d2ce89336b437b2cab01b267a9a251f9a9a809e4b2a3ffba39afe733271c29ec672e18a6827f1e40fb4c44ca56193f89710072a3025a9b9c871b8ef68cc2d7ef5e07e0f82a86fb6ba6c834377cd8a9217a19e5b78163d45e23372dde166ca99d3c9c526fd0d680446aeb6d99b8cbe19beb1c6f219e35c02ca2cd86f4a07d9c935da4075f2c4a7196f9e42109875e6958b60bcedc512d78aced5985c569603c5ee770635ffcfe4ee3f1361eedbda2d85f0cdae9db2180945c392a17217fc47b6a00b2cf1c4de4368086a5f3bf07663fbcc062ca6c6e20eb5b9be248f	rdclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3DD483E2BBF4C05E8AF10F5FA7626CFD3DC3092\Blob = 0400000001000000100000006d469ed9256d08235b5e747d1e27dbf20f00000001000000400000005cf58dc4429325fb69e9498383333acbf76eddfd5845bb9d29fdb935b2652c9184295565157a1d83335f9b67e3e2b67d6c01238ce81adecbf3d75e98b3e99d7953000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b0000000100000038000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410020003200000009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000b676f2eddae8775cd36cb0f63cd1d4603961f49e6265ba013a2f0307b6d0b804140000000100000014000000b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd1d000000010000001000000004321ccbc528a397f1620cb39dfc6d35030000000100000014000000d3dd483e2bbf4c05e8af10f5fa7626cfd3dc309219000000010000001000000015b8b4807e45c1ae49fa34daa40347e62000000001000000d6050000308205d2308203baa003020102021021d6d04a4f250fc93237fcaa5e128de9300d06092a864886f70d01010d0500308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b20434120323022180f32303131313030363038333935365a180f32303436313030363038333935365a308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100bdf978f8e6d5800c649d861b9664673f223a1e75017deffb5c678cc9cc5c6ba991e6b942e5204b9bda9b7bb9995dd99b804bd784402b27d3e8ba30bb3e091aa74995ef2b4024c297c7a7ee9b25efa80a0097855aaa9ddc29c9e23507eb704d4ad6c1b356b8a141389bd1fb317f8fe05fe1b13f0f8e164960d7068d18f9aa2610ab2ad3d0d1678d1b46be4730d52e72d1c563dae76379447e4b632489862e343f294c528b2aa7c0e2912889b9c05bf91dd9e727adff9a0297c1c650929b022cbda9b934590abf844affdffeb39febd99ee09823eca66b77162adbccad3b1ca487dc46735e1962684557e4908242bb42d6f061e0c1a33d66a35df418ee88c98d1745299932750231ee2926c86b02e6b562457f37155a236889d43ede4e27b0f0400cbc4d17cb4da2b31ed0065addf693cf577599f5fa861a6778b3bf96fe34dcbde75256e5b3e5757bd7419105dc5d69e3950d43b9fc839639957b6c805a4f1372c6d77d297a44ba52a42ad541460920fe22a0b65b308dbc890cd5d770f88752fddaefac512e07b34efed009da70ef98fa56e66ddbb5574bdce52c2515c89e2e784ef8da9c9e862cca57f31ae5c8928b1a82967ac3bc501269d80e5a468b3aeb26fa23c9b6b081be4200a4f8d6fe302ec7d246f6e58e75fdf2ccb9d0875bcc061060bb8335b75e67de47ec9948f1a4a115fead8c628e39554f3916b9b1639dffb70203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e04160414b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd300e0603551d0f0101ff040403020106300d06092a864886f70d01010d0500038202010071a50ecee4e9bf3f38d5895ac40261fb4cc514172d8b4f536b1017fc6584c7104990dedbc7269388266f70d6025e39a0f78fab96b5a5135c81146d0e8182111b8a4ec64fa5dd621e44df0959f45b770b37e98b20c6f80a4e2e581ceb33d0cf8660c9dafb802f9e4c6084783d2164d6fb411f180fe7c97571bdbd5cde34873e41b00ef6b9d63f091396142fde9a1d5ab956ce353ab05f704d5ee329f123287259b6abc28c66261c772c2676358b28a769a0f93bf523dd851074c990035691e7afba47d412971122e3a249946ce7b7944bba2da4da338b4ca644ff5a3cc61d64d8b531e4a63c7aa8570bdbed611acbf1ce737763a4876f4c5138d6e45fc79fb6812ae4854879585e3bf8db028267c139dbc3744b3d361ef9299388685ba8441921f0a7e8810d2ce89336b437b2cab01b267a9a251f9a9a809e4b2a3ffba39afe733271c29ec672e18a6827f1e40fb4c44ca56193f89710072a3025a9b9c871b8ef68cc2d7ef5e07e0f82a86fb6ba6c834377cd8a9217a19e5b78163d45e23372dde166ca99d3c9c526fd0d680446aeb6d99b8cbe19beb1c6f219e35c02ca2cd86f4a07d9c935da4075f2c4a7196f9e42109875e6958b60bcedc512d78aced5985c569603c5ee770635ffcfe4ee3f1361eedbda2d85f0cdae9db2180945c392a17217fc47b6a00b2cf1c4de4368086a5f3bf07663fbcc062ca6c6e20eb5b9be248f	rdclient.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D3DD483E2BBF4C05E8AF10F5FA7626CFD3DC3092\Blob = 5c00000001000000040000000010000019000000010000001000000015b8b4807e45c1ae49fa34daa40347e6030000000100000014000000d3dd483e2bbf4c05e8af10f5fa7626cfd3dc30921d000000010000001000000004321ccbc528a397f1620cb39dfc6d35140000000100000014000000b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd620000000100000020000000b676f2eddae8775cd36cb0f63cd1d4603961f49e6265ba013a2f0307b6d0b80409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010b0000000100000038000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410020003200000053000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000400000005cf58dc4429325fb69e9498383333acbf76eddfd5845bb9d29fdb935b2652c9184295565157a1d83335f9b67e3e2b67d6c01238ce81adecbf3d75e98b3e99d790400000001000000100000006d469ed9256d08235b5e747d1e27dbf22000000001000000d6050000308205d2308203baa003020102021021d6d04a4f250fc93237fcaa5e128de9300d06092a864886f70d01010d0500308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b20434120323022180f32303131313030363038333935365a180f32303436313030363038333935365a308180310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312430220603550403131b43657274756d2054727573746564204e6574776f726b204341203230820222300d06092a864886f70d01010105000382020f003082020a0282020100bdf978f8e6d5800c649d861b9664673f223a1e75017deffb5c678cc9cc5c6ba991e6b942e5204b9bda9b7bb9995dd99b804bd784402b27d3e8ba30bb3e091aa74995ef2b4024c297c7a7ee9b25efa80a0097855aaa9ddc29c9e23507eb704d4ad6c1b356b8a141389bd1fb317f8fe05fe1b13f0f8e164960d7068d18f9aa2610ab2ad3d0d1678d1b46be4730d52e72d1c563dae76379447e4b632489862e343f294c528b2aa7c0e2912889b9c05bf91dd9e727adff9a0297c1c650929b022cbda9b934590abf844affdffeb39febd99ee09823eca66b77162adbccad3b1ca487dc46735e1962684557e4908242bb42d6f061e0c1a33d66a35df418ee88c98d1745299932750231ee2926c86b02e6b562457f37155a236889d43ede4e27b0f0400cbc4d17cb4da2b31ed0065addf693cf577599f5fa861a6778b3bf96fe34dcbde75256e5b3e5757bd7419105dc5d69e3950d43b9fc839639957b6c805a4f1372c6d77d297a44ba52a42ad541460920fe22a0b65b308dbc890cd5d770f88752fddaefac512e07b34efed009da70ef98fa56e66ddbb5574bdce52c2515c89e2e784ef8da9c9e862cca57f31ae5c8928b1a82967ac3bc501269d80e5a468b3aeb26fa23c9b6b081be4200a4f8d6fe302ec7d246f6e58e75fdf2ccb9d0875bcc061060bb8335b75e67de47ec9948f1a4a115fead8c628e39554f3916b9b1639dffb70203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e04160414b6a1543902c3a03f8e8abcfad4f81ca6d13a0efd300e0603551d0f0101ff040403020106300d06092a864886f70d01010d0500038202010071a50ecee4e9bf3f38d5895ac40261fb4cc514172d8b4f536b1017fc6584c7104990dedbc7269388266f70d6025e39a0f78fab96b5a5135c81146d0e8182111b8a4ec64fa5dd621e44df0959f45b770b37e98b20c6f80a4e2e581ceb33d0cf8660c9dafb802f9e4c6084783d2164d6fb411f180fe7c97571bdbd5cde34873e41b00ef6b9d63f091396142fde9a1d5ab956ce353ab05f704d5ee329f123287259b6abc28c66261c772c2676358b28a769a0f93bf523dd851074c990035691e7afba47d412971122e3a249946ce7b7944bba2da4da338b4ca644ff5a3cc61d64d8b531e4a63c7aa8570bdbed611acbf1ce737763a4876f4c5138d6e45fc79fb6812ae4854879585e3bf8db028267c139dbc3744b3d361ef9299388685ba8441921f0a7e8810d2ce89336b437b2cab01b267a9a251f9a9a809e4b2a3ffba39afe733271c29ec672e18a6827f1e40fb4c44ca56193f89710072a3025a9b9c871b8ef68cc2d7ef5e07e0f82a86fb6ba6c834377cd8a9217a19e5b78163d45e23372dde166ca99d3c9c526fd0d680446aeb6d99b8cbe19beb1c6f219e35c02ca2cd86f4a07d9c935da4075f2c4a7196f9e42109875e6958b60bcedc512d78aced5985c569603c5ee770635ffcfe4ee3f1361eedbda2d85f0cdae9db2180945c392a17217fc47b6a00b2cf1c4de4368086a5f3bf07663fbcc062ca6c6e20eb5b9be248f	rdclient.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
872	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1724	税務報告書.exe
1724	税務報告書.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4472	rdclient.exe
4472	rdclient.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe
4208	rdservice.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4208	rdservice.exe
Token: SeDebugPrivilege	4208	rdservice.exe
Token: SeDebugPrivilege	4472	rdclient.exe
Token: SeDebugPrivilege	4472	rdclient.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4472	rdclient.exe
4472	rdclient.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 5060	1724	税務報告書.exe	88
PID 4208 wrote to memory of 4472	4208	rdservice.exe	90
PID 5060 wrote to memory of 872	5060	cmd.exe	91

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	rdclient.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	rdclient.exe

C:\Users\Admin\AppData\Local\Temp\税務報告書.exe
"C:\Users\Admin\AppData\Local\Temp\税務報告書.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping -n 2 127.0.0.1 >nul 2>&1 && del /f /q "C:\Users\Admin\AppData\Local\Temp\税務報告書.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:872

C:\ProgramData\host\rdservice.exe
"C:\ProgramData\host\rdservice.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208
- C:\ProgramData\host\rdclient.exe
  C:\ProgramData\host\rdclient.exe quiet
  2⤵
  - UAC bypass
  - Drops file in System32 directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:4472

C:\ProgramData\host\rdclient.exe
"C:\ProgramData\host\rdclient.exe" plugin
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

69b357622c057e8b763cd1058ad72c0d_1387e72d-6ef0-4d6f-9d55-a268230a0331

Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\69b357622c057e8b763cd1058ad72c0d_1387e72d-6ef0-4d6f-9d55-a268230a0331
Size 50B
SHA256 e2ae3c0449da6c8871193c001ae6d86323f380730712482b319247e9878cc84f
MD5 73b4c819d05c312210898f6f62f8a898
SHA1 bf8448f76118681e00ce047a1e4257d4262d2bb3
SHA512 f9f97761dafd1b988624218c59e87b1d7e294bed9dceee2ae9442b0151a1f7f866a6362b59965f0e9d79a3ff365e3619dfc56030e2569327e915419b62083f18
MD5 SHA1 SHA512

Submit Download

cfg.ini

Path C:\ProgramData\host\cfg.ini
Size 171B
SHA256 7f49d9c3239199bfd6a8923bff31a43025751a6665c74ce4666acdcee6c2e9b0
MD5 9d44c5fe8fb486ffb1fd97c1f7b123f2
SHA1 4ba0db13f49a1b39f0af1322eb1c733cf521cf00
SHA512 2f1d764d1982378bd49cd1b5a66d5079d89b1a33cf7a42333138336f13dbf447bbc03e796c3a08c588600c7aefe4ca0ae3a4c9b4b69333aa08c86da359156ee7
TLSH
T156C08015E55AB19155FD112C804745988682FF047E279844549444C5ED6C1F2270A91D
MD5 SHA1 SHA512 TLSH

Submit Download

host.dat

Path C:\ProgramData\host\host.dat
Size 130B
SHA256 43701a2a1571ce9419b9b3c3634f61e2b815dd9e48c6cc5468b974c11d1dad05
MD5 f6990bb8c71d597791ae22fa9aaf3635
SHA1 41e3234d200b0ee56da2135c33bddfe4de24a806
SHA512 312663cee5d8a97559108de5875772e65f8648e09608e01e0079b809935a84b5a388905055e520763e708841147fe4f843ca7df156c46ff72d66d72aac1cd0d3
TLSH
T1A8C02208EE28CC00E2C8A3088880FE30A02C3A2C80A208AE22282320030880C00AA30E
MD5 SHA1 SHA512 TLSH

Submit Download

rdclient.exe

Path C:\ProgramData\host\rdclient.exe
Size 24.2MB
SHA256 fbd1c4542c3e7dff95e72733a16815e457cb437e06991f21fb09bf7271ace8ac
MD5 b493bbd1f3a3a169461a02bf220ec3b6
SHA1 f3304ed51f45af1c0eef7c77957beb69bad36c4c
SHA512 86b2fcc3243bde3bbe21c55d3c742fad5b563c04d6b9a219270217024672900229f0e826f34c635050e4a468ad06070d33173e7fcee5aadaf90efc33b781b059
SSDEEP 393216:3gOGWXPUvKx72yH44OrEsawep5U/eimN0X/TyzwRRL+sx0EXWQUFsXm:3PvUm72yY1Hawe3imOPTowRgsFXuam
TLSH
T1C947334672FF02D5CEE692FC23988D0B93C994CB599464EB1AC11E2DD3930BBA5D01F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rdservice.exe

Path C:\ProgramData\host\rdservice.exe
Size 2.5MB
SHA256 7ed2a077a1ce34fcb182e5135ae75ad7bd96207c3204c9f343095f967bfa109f
MD5 db3d3a7f82f0c7afb258a98c50a66a36
SHA1 8cc26bec161dc58472e848c427310ae396520f88
SHA512 73b54dc39fbb512054168ad59acaf00b2177138091869f6df46a8fa24b98e977092617cc89d32cad5690f8e930715352003adde7d3a0ac9a1c9fcb942f62471e
SSDEEP 24576:dEGJjsQPX8V/vLGUFAyzEVSg1F2+kkROf4pY7DH7cpFVBqSRg/lIhu/WST5V2tSw:Ts8Xi3LdFb0MR7uVASC/rWSrU3
TLSH
T127C55B23B2D9653ED06B173A5827B6145C3BB7A13A2A9C0797F4084C9F296C13E3B747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1604-72-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/1604-69-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/1724-0-0x0000000000020000-0x0000000001AF6000-memory.dmp

Download

memory/1724-1-0x0000000001BD0000-0x0000000001BD3000-memory.dmp

Download

memory/1724-10-0x0000000000020000-0x0000000001AF6000-memory.dmp

Download

memory/4208-37-0x0000000000D50000-0x0000000000D51000-memory.dmp

Download

memory/4208-8-0x0000000000D50000-0x0000000000D51000-memory.dmp

Download

memory/4208-35-0x0000000000D70000-0x0000000001007000-memory.dmp

Download

memory/4472-13-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-71-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-60-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-63-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-65-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-66-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-36-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-58-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-51-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-74-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-76-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-78-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-80-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download

memory/4472-82-0x0000000000740000-0x0000000002AC1000-memory.dmp

Download