df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7

General

Target

df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe
Size

92KB
MD5

87c6b6126794ac02577d23501ee9b090
SHA1

3736409ef983e7cb8ea28f6d74d606638935cef1
SHA256

df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7
SHA512

31cf5bf68dc8e0a8a5a7c2dfa25e61c1376433f3c465b92a1c6014f41961a5ac853070720672e0ca522ebb34e9fbb545171eadd1126ead784950426c5ad5551b
SSDEEP

1536:E+359vJUVMUQA9DMIE+Zu7vvQT9Dq7r8MfBaQorHRZ83YacIyP/69QAq0Gb8/Z5o:/BTmIIcv6QrRCnKYBbWq0GQP0oKz

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

urdvxc.exeurdvxc.exeurdvxc.exeurdvxc.exe

pid process

832 urdvxc.exe
2764 urdvxc.exe
3488 urdvxc.exe
364 urdvxc.exe

pid	process
832	urdvxc.exe
2764	urdvxc.exe
3488	urdvxc.exe
364	urdvxc.exe

Drops file in System32 directory 3 IoCs

Processes:

df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exeurdvxc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe

Drops file in Program Files directory 4 IoCs

Processes:

urdvxc.exe

description	ioc	process
File opened for modification	C:\Program Files\EnterStart.htm	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\qrhljwvn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html	urdvxc.exe

Modifies registry class 24 IoCs

Processes:

urdvxc.exeurdvxc.exeurdvxc.exeurdvxc.exedf8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\db\\qrhljwvn.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D57891CE-BE19-8D41-63F7-299CC869E3A9}\LocalServer32	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D57891CE-BE19-8D41-63F7-299CC869E3A9}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe"	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "lxbnqvbttjrbsete"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "zslcbxlelhhjhlbn"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "whwtbkrerehjeqlh"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\ = "klekerrnnljksknz"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D57891CE-BE19-8D41-63F7-299CC869E3A9}	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D57891CE-BE19-8D41-63F7-299CC869E3A9}\ = "jlhkqnslecjznkbw"	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "nllhkrhhrtxjlbbl"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

urdvxc.exe

description pid process

Token: SeDebugPrivilege 832 urdvxc.exe

description	pid	process
Token: SeDebugPrivilege	832	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe

description	pid	process	target process
PID 3792 wrote to memory of 832	3792	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe	urdvxc.exe
PID 3792 wrote to memory of 832	3792	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe	urdvxc.exe
PID 3792 wrote to memory of 832	3792	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe	urdvxc.exe
PID 3792 wrote to memory of 2764	3792	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe	urdvxc.exe
PID 3792 wrote to memory of 2764	3792	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe	urdvxc.exe
PID 3792 wrote to memory of 2764	3792	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe	urdvxc.exe
PID 3792 wrote to memory of 364	3792	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe	urdvxc.exe
PID 3792 wrote to memory of 364	3792	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe	urdvxc.exe
PID 3792 wrote to memory of 364	3792	df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe	urdvxc.exe

C:\Users\Admin\AppData\Local\Temp\df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe
"C:\Users\Admin\AppData\Local\Temp\df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3792

C:\Windows\SysWOW64\urdvxc.exe
C:\Windows\system32\urdvxc.exe /installservice
2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:832

C:\Windows\SysWOW64\urdvxc.exe
C:\Windows\system32\urdvxc.exe /start
2⤵
- Executes dropped EXE
- Modifies registry class
PID:2764

C:\Windows\SysWOW64\urdvxc.exe
C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7.exe
2⤵
- Executes dropped EXE
- Modifies registry class
PID:364

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:3488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\urdvxc.exe

Filesize
92KB

MD5
87c6b6126794ac02577d23501ee9b090

SHA1
3736409ef983e7cb8ea28f6d74d606638935cef1

SHA256
df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7

SHA512
31cf5bf68dc8e0a8a5a7c2dfa25e61c1376433f3c465b92a1c6014f41961a5ac853070720672e0ca522ebb34e9fbb545171eadd1126ead784950426c5ad5551b

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
92KB

MD5
87c6b6126794ac02577d23501ee9b090

SHA1
3736409ef983e7cb8ea28f6d74d606638935cef1

SHA256
df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7

SHA512
31cf5bf68dc8e0a8a5a7c2dfa25e61c1376433f3c465b92a1c6014f41961a5ac853070720672e0ca522ebb34e9fbb545171eadd1126ead784950426c5ad5551b

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
92KB

MD5
87c6b6126794ac02577d23501ee9b090

SHA1
3736409ef983e7cb8ea28f6d74d606638935cef1

SHA256
df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7

SHA512
31cf5bf68dc8e0a8a5a7c2dfa25e61c1376433f3c465b92a1c6014f41961a5ac853070720672e0ca522ebb34e9fbb545171eadd1126ead784950426c5ad5551b

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
92KB

MD5
87c6b6126794ac02577d23501ee9b090

SHA1
3736409ef983e7cb8ea28f6d74d606638935cef1

SHA256
df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7

SHA512
31cf5bf68dc8e0a8a5a7c2dfa25e61c1376433f3c465b92a1c6014f41961a5ac853070720672e0ca522ebb34e9fbb545171eadd1126ead784950426c5ad5551b

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
92KB

MD5
87c6b6126794ac02577d23501ee9b090

SHA1
3736409ef983e7cb8ea28f6d74d606638935cef1

SHA256
df8545ac9b13e53eb9a76dfea3851731821dbb3829540956b21b1931e9f724a7

SHA512
31cf5bf68dc8e0a8a5a7c2dfa25e61c1376433f3c465b92a1c6014f41961a5ac853070720672e0ca522ebb34e9fbb545171eadd1126ead784950426c5ad5551b

Download Submit
memory/364-146-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/364-144-0x0000000000000000-mapping.dmp

Download
memory/832-136-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/832-137-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/832-133-0x0000000000000000-mapping.dmp

Download
memory/2764-139-0x0000000000000000-mapping.dmp

Download
memory/2764-142-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/3488-143-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/3488-147-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/3792-138-0x0000000000510000-0x000000000052F000-memory.dmp

Filesize
124KB

Download
memory/3792-132-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads