File name:

RDP Stealer V2.exe

Full analysis: https://app.any.run/tasks/f4efdf8d-bbad-4b2f-99f9-965070badbe7
Verdict: Malicious activity
Analysis date: December 17, 2023, 15:54:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

DCE7BF8A2A489BE0B09B252C8CD21642

SHA1:

942D302D83FF0A0335916D239605804F4F73ED3C

SHA256:

80BDF2A2192E26A1A3C9BFB01DA6A5679414B752ACF21CFD3879EB93216F634F

SSDEEP:

98304:cy77lBAlFiblkvqe50Xx/vpCbbZS+n/27yXlmeAiqkueri8Y2/ytTigoitU1SQ2g:XfJ3r6AL6T2OJvhDKtJNB1VD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts Visual C# compiler

      • RDP Stealer V2.exe (PID: 2120)

    • Drops the executable file immediately after the start

      • csc.exe (PID: 1344)

    • Starts NET.EXE to view/add/change user profiles

      • powershell.exe (PID: 1824)
      • net.exe (PID: 2340)

    • Starts NET.EXE to view/change users localgroup

      • powershell.exe (PID: 1748)
      • net.exe (PID: 1924)
      • powershell.exe (PID: 1384)
      • net.exe (PID: 2760)

  • SUSPICIOUS

    • Reads the Internet Settings

      • RDP Stealer V2.exe (PID: 2120)
      • dddd.exe (PID: 696)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • RDP Stealer V2.exe (PID: 2120)
      • dddd.exe (PID: 696)

    • Reads settings of System Certificates

      • RDP Stealer V2.exe (PID: 2120)
      • dddd.exe (PID: 696)

    • Uses .NET C# to load dll

      • RDP Stealer V2.exe (PID: 2120)

    • Starts POWERSHELL.EXE for commands execution

      • dddd.exe (PID: 696)

    • Executing commands from ".cmd" file

      • dddd.exe (PID: 696)

    • Checks for external IP

      • dddd.exe (PID: 696)

    • Starts CMD.EXE for commands execution

      • dddd.exe (PID: 696)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2804)

  • INFO

    • Reads Environment values

      • RDP Stealer V2.exe (PID: 2120)
      • dddd.exe (PID: 696)

    • Reads the machine GUID from the registry

      • RDP Stealer V2.exe (PID: 2120)
      • csc.exe (PID: 1344)
      • cvtres.exe (PID: 572)
      • dddd.exe (PID: 696)

    • Reads the computer name

      • RDP Stealer V2.exe (PID: 2120)
      • dddd.exe (PID: 696)

    • Checks supported languages

      • RDP Stealer V2.exe (PID: 2120)
      • csc.exe (PID: 1344)
      • cvtres.exe (PID: 572)
      • dddd.exe (PID: 696)

    • Create files in a temporary directory

      • RDP Stealer V2.exe (PID: 2120)
      • cvtres.exe (PID: 572)
      • dddd.exe (PID: 696)

    • Manual execution by a user

      • dddd.exe (PID: 696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:13 15:33:14+01:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 9525760
InitializedDataSize: 8192
UninitializedDataSize: -
EntryPoint: 0x9179ee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: RDP Stealer FUD V2
FileVersion: 1.0.0.0
InternalName: RDP Stealer.exe
LegalCopyright: Copyright © 2023
LegalTrademarks: -
OriginalFileName: RDP Stealer.exe
ProductName: RDP Stealer FUD V2
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
15
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start rdp stealer v2.exe csc.exe no specs cvtres.exe no specs dddd.exe powershell.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
572C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES8691.tmp" "c:\Users\admin\Desktop\CSCFE9BA08754B04E1B9BAA9F836CC1E9A.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.10.25028.0 built by: VCTOOLSD15RTM
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\vcruntime140_clr0400.dll
c:\windows\system32\ucrtbase_clr0400.dll
696"C:\Users\admin\Desktop\dddd.exe" C:\Users\admin\Desktop\dddd.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\dddd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1344"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\k2f4fckv.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe—RDP Stealer V2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\vcruntime140_clr0400.dll
c:\windows\system32\ucrtbase_clr0400.dll
1384"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" net localgroup "Remote Desktop Users" ThanksEgalsa /addC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—dddd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1748"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" net localgroup administrators ThanksEgalsa /addC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—dddd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1824"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" net user ThanksEgalsa ThanksEgalsa /addC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—dddd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1924"C:\Windows\system32\net.exe" localgroup administrators ThanksEgalsa /addC:\Windows\System32\net.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
2120"C:\Users\admin\AppData\Local\Temp\RDP Stealer V2.exe" C:\Users\admin\AppData\Local\Temp\RDP Stealer V2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RDP Stealer FUD V2
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rdp stealer v2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2340"C:\Windows\system32\net.exe" user ThanksEgalsa ThanksEgalsa /addC:\Windows\System32\net.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
2404C:\Windows\system32\net1 localgroup Remote Desktop Users ThanksEgalsa /addC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
Total events
11 022
Read events
10 931
Write events
88
Delete events
3

Modification events

(PID) Process:(2120) RDP Stealer V2.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2120) RDP Stealer V2.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(2120) RDP Stealer V2.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
06000000000000000B0000000100000002000000070000000C0000000D0000000A0000000900000008000000030000000500000004000000FFFFFFFF
(PID) Process:(2120) RDP Stealer V2.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
0200000006000000000000000B00000001000000070000000C0000000D0000000A0000000900000008000000030000000500000004000000FFFFFFFF
(PID) Process:(2120) RDP Stealer V2.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_FolderType
Value:
{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}
(PID) Process:(2120) RDP Stealer V2.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewID
Value:
{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
(PID) Process:(2120) RDP Stealer V2.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewVersion
Value:
0
(PID) Process:(2120) RDP Stealer V2.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:Mode
Value:
4
(PID) Process:(2120) RDP Stealer V2.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:LogicalViewMode
Value:
1
(PID) Process:(2120) RDP Stealer V2.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:FFlags
Value:
1
Executable files
1
Suspicious files
13
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
572cvtres.exeC:\Users\admin\AppData\Local\Temp\RES8691.tmpbinary
MD5:F53C423F846931C59FFC8557C8D78AA0
SHA256:D03C26AF98370A3DDDD8183F0C7903595F861ED134A4CB9C3B3B611EAAFCB73D
2120RDP Stealer V2.exeC:\Users\admin\AppData\Local\Temp\k2f4fckv.0.cstext
MD5:53873D216767033B9A389F7CFFCB7442
SHA256:1EEAA46B4864AA9DEFD05F1C021754903BB7F89ECD1CCF755EEBB11F9AF3553A
1824powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
1344csc.exeC:\Users\admin\AppData\Local\Temp\k2f4fckv.outtext
MD5:D866D7EB3D95EB086635966BF01FE40F
SHA256:1C293577AAC81B783D7D1002562A41CD4228D17A39861BFB89F91B9DF4B7A61F
1824powershell.exeC:\Users\admin\AppData\Local\Temp\o0botnw2.5p3.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1344csc.exeC:\Users\admin\Desktop\dddd.exeexecutable
MD5:0C2BF7CE2B125BD3B8D5701BE03F1FC6
SHA256:3C68AD2625DB9A7CB3AB436CC3D09F7CB30BB1199070D666B93F07D917095528
1748powershell.exeC:\Users\admin\AppData\Local\Temp\bwj1ev2a.uu0.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
696dddd.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
1384powershell.exeC:\Users\admin\AppData\Local\Temp\f4d5kibi.3lx.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1748powershell.exeC:\Users\admin\AppData\Local\Temp\jpwvyr3z.ro2.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
3
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
696
dddd.exe
GET
200
2.19.198.51:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?92c813679a88347f
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
RDP Stealer V2.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
unknown
696
dddd.exe
34.117.118.44:443
www.ifconfig.me
GOOGLE-CLOUD-PLATFORM
US
unknown
696
dddd.exe
2.19.198.51:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
696
dddd.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
unknown

DNS requests

Domain
IP
Reputation
api.telegram.org
  • 149.154.167.220
shared
www.ifconfig.me
  • 34.117.118.44
unknown
ctldl.windowsupdate.com
  • 2.19.198.51
  • 23.32.238.121
  • 23.32.238.113
  • 23.32.238.144
  • 2.19.198.64
  • 23.32.238.152
  • 23.32.238.129
  • 2.19.198.41
  • 2.19.198.66
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
2120
RDP Stealer V2.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
2120
RDP Stealer V2.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
1080
svchost.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External IP Lookup Domain (ifconfig .me in DNS lookup)
696
dddd.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL/TLS Certificate (ifconfig .me)
696
dddd.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
696
dddd.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RDP Stealer V2.exe