bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773

General

Target

bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe
Size

90KB
MD5

474df35b4480320b8f8752def8f5c062
SHA1

260df0a8545cb59e8c1945c60a0cf26c6706e373
SHA256

bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773
SHA512

73fc10d2b79099a66375352cd745177f5a69d7d55dc793f50a81aee781a353462e20349f1248c3c0cdecb073339406e28770d2489f1b0833030efbe01e7a9dbb
SSDEEP

1536:c2te/LgkQHYQ66eKdUxIur5i4Dv2bE+2QklIyjpbgotBN8WKutyG0QMUX:/M/xge6ZU5rRDv2bNWe09gotfbtLX

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

urdvxc.exeurdvxc.exeurdvxc.exeurdvxc.exe

pid process

4760 urdvxc.exe
5104 urdvxc.exe
4540 urdvxc.exe
2124 urdvxc.exe

pid	process
4760	urdvxc.exe
5104	urdvxc.exe
4540	urdvxc.exe
2124	urdvxc.exe

Drops file in System32 directory 3 IoCs

Processes:

bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exeurdvxc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\urdvxc.exe	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Modifies registry class 20 IoCs

Processes:

bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exeurdvxc.exeurdvxc.exeurdvxc.exeurdvxc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64CE9320-5294-3DBD-2A99-53EE21075135}\ = "qnlhnsljwcvrswqt"	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "stklntnklqeklvbe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64CE9320-5294-3DBD-2A99-53EE21075135}	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64CE9320-5294-3DBD-2A99-53EE21075135}\LocalServer32	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64CE9320-5294-3DBD-2A99-53EE21075135}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe"	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "sxehzhrhetstkqcs"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ehttxknjtrewlxch"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bbvcbbwxebjjhzks"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

urdvxc.exe

description pid process

Token: SeDebugPrivilege 4760 urdvxc.exe

description	pid	process
Token: SeDebugPrivilege	4760	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe

description	pid	process	target process
PID 4376 wrote to memory of 4760	4376	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	urdvxc.exe
PID 4376 wrote to memory of 4760	4376	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	urdvxc.exe
PID 4376 wrote to memory of 4760	4376	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	urdvxc.exe
PID 4376 wrote to memory of 5104	4376	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	urdvxc.exe
PID 4376 wrote to memory of 5104	4376	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	urdvxc.exe
PID 4376 wrote to memory of 5104	4376	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	urdvxc.exe
PID 4376 wrote to memory of 2124	4376	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	urdvxc.exe
PID 4376 wrote to memory of 2124	4376	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	urdvxc.exe
PID 4376 wrote to memory of 2124	4376	bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe	urdvxc.exe

C:\Users\Admin\AppData\Local\Temp\bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe
"C:\Users\Admin\AppData\Local\Temp\bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4376

C:\Windows\SysWOW64\urdvxc.exe
C:\Windows\system32\urdvxc.exe /installservice
2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Windows\SysWOW64\urdvxc.exe
C:\Windows\system32\urdvxc.exe /start
2⤵
- Executes dropped EXE
- Modifies registry class
PID:5104

C:\Windows\SysWOW64\urdvxc.exe
C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773.exe
2⤵
- Executes dropped EXE
- Modifies registry class
PID:2124

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\urdvxc.exe
Filesize
90KB

MD5
474df35b4480320b8f8752def8f5c062

SHA1
260df0a8545cb59e8c1945c60a0cf26c6706e373

SHA256
bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773

SHA512
73fc10d2b79099a66375352cd745177f5a69d7d55dc793f50a81aee781a353462e20349f1248c3c0cdecb073339406e28770d2489f1b0833030efbe01e7a9dbb

Download Submit
C:\Windows\SysWOW64\urdvxc.exe
Filesize
90KB

MD5
474df35b4480320b8f8752def8f5c062

SHA1
260df0a8545cb59e8c1945c60a0cf26c6706e373

SHA256
bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773

SHA512
73fc10d2b79099a66375352cd745177f5a69d7d55dc793f50a81aee781a353462e20349f1248c3c0cdecb073339406e28770d2489f1b0833030efbe01e7a9dbb

Download Submit
C:\Windows\SysWOW64\urdvxc.exe
Filesize
90KB

MD5
474df35b4480320b8f8752def8f5c062

SHA1
260df0a8545cb59e8c1945c60a0cf26c6706e373

SHA256
bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773

SHA512
73fc10d2b79099a66375352cd745177f5a69d7d55dc793f50a81aee781a353462e20349f1248c3c0cdecb073339406e28770d2489f1b0833030efbe01e7a9dbb

Download Submit
C:\Windows\SysWOW64\urdvxc.exe
Filesize
90KB

MD5
474df35b4480320b8f8752def8f5c062

SHA1
260df0a8545cb59e8c1945c60a0cf26c6706e373

SHA256
bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773

SHA512
73fc10d2b79099a66375352cd745177f5a69d7d55dc793f50a81aee781a353462e20349f1248c3c0cdecb073339406e28770d2489f1b0833030efbe01e7a9dbb

Download Submit
C:\Windows\SysWOW64\urdvxc.exe
Filesize
90KB

MD5
474df35b4480320b8f8752def8f5c062

SHA1
260df0a8545cb59e8c1945c60a0cf26c6706e373

SHA256
bd39ffa08d0b0b3fa866339bf7e35950b82a32ad8c85bd1d333cb109a9b52773

SHA512
73fc10d2b79099a66375352cd745177f5a69d7d55dc793f50a81aee781a353462e20349f1248c3c0cdecb073339406e28770d2489f1b0833030efbe01e7a9dbb

Download Submit
memory/2124-143-0x0000000000000000-mapping.dmp

Download
memory/2124-145-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/4376-133-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4376-132-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4540-146-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4540-147-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4760-137-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/4760-138-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4760-134-0x0000000000000000-mapping.dmp

Download
memory/5104-139-0x0000000000000000-mapping.dmp

Download
memory/5104-142-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads