65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2

General

Target

65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe
Size

91KB
MD5

72397ba24ace1bbaec53347913cfca94
SHA1

6e16b129d2f8ee995562daa1b6ae5452920af830
SHA256

65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2
SHA512

f0234b4a7f3c665f92b1da4577eb3b348544ab904f65132fff17f562889ccb4702b0b8e7d540b7b075c9254cbb96637ab99e4e32d8de4aca66a29ab641d86b6d
SSDEEP

1536:i5OS6zqt3GZRsXQc3W141WFx2hEMKaDBvHks4SL/Dcq5vuAtVMxmKuATB3Nb3qwP:MObqtCsX3Acux2hEOB/rXPl/0mA3Njqc

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

urdvxc.exeurdvxc.exeurdvxc.exeurdvxc.exe

pid process

2816 urdvxc.exe
2248 urdvxc.exe
1784 urdvxc.exe
1028 urdvxc.exe

pid	process
2816	urdvxc.exe
2248	urdvxc.exe
1784	urdvxc.exe
1028	urdvxc.exe

Drops file in System32 directory 3 IoCs

Processes:

65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exeurdvxc.exe

description	ioc	process
File created	C:\Windows\SysWOW64\urdvxc.exe	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Modifies registry class 20 IoCs

Processes:

65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exeurdvxc.exeurdvxc.exeurdvxc.exeurdvxc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B74A296F-907A-F33D-5ECF-ED3801D0B462}	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B74A296F-907A-F33D-5ECF-ED3801D0B462}\LocalServer32	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "tzhttwxlrebznker"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "wzelvsvsrskqsrvc"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "retnrrkkxhkknjcw"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B74A296F-907A-F33D-5ECF-ED3801D0B462}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe"	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B74A296F-907A-F33D-5ECF-ED3801D0B462}\ = "ejhvxsjktrrkhess"	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "nqeelcrqrzcjllze"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

urdvxc.exe

description pid process

Token: SeDebugPrivilege 2816 urdvxc.exe

description	pid	process
Token: SeDebugPrivilege	2816	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe

description	pid	process	target process
PID 3176 wrote to memory of 2816	3176	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe	urdvxc.exe
PID 3176 wrote to memory of 2816	3176	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe	urdvxc.exe
PID 3176 wrote to memory of 2816	3176	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe	urdvxc.exe
PID 3176 wrote to memory of 2248	3176	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe	urdvxc.exe
PID 3176 wrote to memory of 2248	3176	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe	urdvxc.exe
PID 3176 wrote to memory of 2248	3176	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe	urdvxc.exe
PID 3176 wrote to memory of 1784	3176	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe	urdvxc.exe
PID 3176 wrote to memory of 1784	3176	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe	urdvxc.exe
PID 3176 wrote to memory of 1784	3176	65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe	urdvxc.exe

C:\Users\Admin\AppData\Local\Temp\65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe
"C:\Users\Admin\AppData\Local\Temp\65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3176

C:\Windows\SysWOW64\urdvxc.exe
C:\Windows\system32\urdvxc.exe /installservice
2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2816

C:\Windows\SysWOW64\urdvxc.exe
C:\Windows\system32\urdvxc.exe /start
2⤵
- Executes dropped EXE
- Modifies registry class
PID:2248

C:\Windows\SysWOW64\urdvxc.exe
C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2.exe
2⤵
- Executes dropped EXE
- Modifies registry class
PID:1784

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\urdvxc.exe

Filesize
91KB

MD5
72397ba24ace1bbaec53347913cfca94

SHA1
6e16b129d2f8ee995562daa1b6ae5452920af830

SHA256
65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2

SHA512
f0234b4a7f3c665f92b1da4577eb3b348544ab904f65132fff17f562889ccb4702b0b8e7d540b7b075c9254cbb96637ab99e4e32d8de4aca66a29ab641d86b6d

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
91KB

MD5
72397ba24ace1bbaec53347913cfca94

SHA1
6e16b129d2f8ee995562daa1b6ae5452920af830

SHA256
65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2

SHA512
f0234b4a7f3c665f92b1da4577eb3b348544ab904f65132fff17f562889ccb4702b0b8e7d540b7b075c9254cbb96637ab99e4e32d8de4aca66a29ab641d86b6d

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
91KB

MD5
72397ba24ace1bbaec53347913cfca94

SHA1
6e16b129d2f8ee995562daa1b6ae5452920af830

SHA256
65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2

SHA512
f0234b4a7f3c665f92b1da4577eb3b348544ab904f65132fff17f562889ccb4702b0b8e7d540b7b075c9254cbb96637ab99e4e32d8de4aca66a29ab641d86b6d

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
91KB

MD5
72397ba24ace1bbaec53347913cfca94

SHA1
6e16b129d2f8ee995562daa1b6ae5452920af830

SHA256
65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2

SHA512
f0234b4a7f3c665f92b1da4577eb3b348544ab904f65132fff17f562889ccb4702b0b8e7d540b7b075c9254cbb96637ab99e4e32d8de4aca66a29ab641d86b6d

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
91KB

MD5
72397ba24ace1bbaec53347913cfca94

SHA1
6e16b129d2f8ee995562daa1b6ae5452920af830

SHA256
65a46f581127479c8e2be553d3316ec04a3899c75015f7bae29b28138d3851b2

SHA512
f0234b4a7f3c665f92b1da4577eb3b348544ab904f65132fff17f562889ccb4702b0b8e7d540b7b075c9254cbb96637ab99e4e32d8de4aca66a29ab641d86b6d

Download Submit
memory/1028-147-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/1028-146-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/1784-141-0x0000000000000000-mapping.dmp

Download
memory/1784-143-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/2248-139-0x0000000000000000-mapping.dmp

Download
memory/2248-144-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/2816-138-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/2816-137-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2816-134-0x0000000000000000-mapping.dmp

Download
memory/3176-132-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3176-133-0x0000000000600000-0x000000000061F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads