sdclt.exe

  • File Path: C:\WINDOWS\system32\sdclt.exe
  • Description: Microsoft Windows Backup

Hashes

Type Hash
MD5 F96744B10792C70426608E670C0E39DB
SHA1 4D64682188DB0A028EC382975D8872CF1B61EBE4
SHA256 DAFB903D3AA945C4AC01011E38F3E232D6BE8B7F9B66B7C3CCB1A1ECFC1B7A90
SHA384 DAD09BFE7A18DE044292CED1F00888D1372907743E7A4605D9791A0A819FEC9A29F0C4463094B19E8A04CF348C015F52
SHA512 D4C3506B48CFF9769DAB360EA2DD38EE64FF5B85B289978EE1A7276757F5009F197EE924385CBD440219600A29E752A78447CBA0A7D079C2B54C1F9A0D1C8D87
SSDEEP 24576:nMmYxJ6XVm85rBkZVUNg0SUxj8AFGh9yptQHZ7RHegR:/YzWVeDVAFGaQ5dH9

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: sdclt.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.18362.1 (WinBuild.160101.0800)
  • Product Version: 10.0.18362.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\Windows\system32\sdclt.exe 46
C:\Windows\system32\sdclt.exe 50
C:\Windows\system32\sdclt.exe 46
C:\Windows\system32\sdclt.exe 52
C:\Windows\system32\sdclt.exe 47

Possible Misuse

The following table contains possible examples of sdclt.exe being misused. While sdclt.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_high_integrity_sdclt.yml title: High Integrity Sdclt Process DRL 1.0
sigma proc_creation_win_high_integrity_sdclt.yml description: A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques. DRL 1.0
sigma proc_creation_win_high_integrity_sdclt.yml Image\|endswith: 'sdclt.exe' DRL 1.0
sigma proc_creation_win_sdclt_child_process.yml title: Sdclt Child Processes DRL 1.0
sigma proc_creation_win_sdclt_child_process.yml description: A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques. DRL 1.0
sigma proc_creation_win_sdclt_child_process.yml ParentImage\|endswith: '\sdclt.exe' DRL 1.0
sigma registry_event_bypass_uac_using_delegateexecute.yml - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md#atomic-test-7---bypass-uac-using-sdclt-delegateexecute DRL 1.0
sigma registry_event_comhijack_sdclt.yml title: COM Hijack via Sdclt DRL 1.0
sigma registry_event_comhijack_sdclt.yml - http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass DRL 1.0
sigma registry_event_uac_bypass_sdclt.yml title: UAC Bypass via Sdclt DRL 1.0
sigma registry_event_uac_bypass_sdclt.yml description: Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53) DRL 1.0
sigma registry_event_uac_bypass_sdclt.yml - https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/ DRL 1.0
malware-ioc misp_invisimole.json "https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/" © ESET 2014-2018
atomic-red-team index.md - Atomic Test #7: Bypass UAC using sdclt DelegateExecute [windows] MIT License. © 2018 Red Canary
atomic-red-team windows-index.md - Atomic Test #7: Bypass UAC using sdclt DelegateExecute [windows] MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md - Atomic Test #7 - Bypass UAC using sdclt DelegateExecute MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md ## Atomic Test #7 - Bypass UAC using sdclt DelegateExecute MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md Upon successful execution, sdclt.exe will spawn cmd.exe to spawn notepad.exe MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md Reference - sevagas.com MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md Start-Process -FilePath $env:windir\system32\sdclt.exe MIT License. © 2018 Red Canary
atomic-red-team T1548.002.md Target: \system32\sdclt.exe MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.