e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f

Analysis

max time kernel
182s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe
Size

111KB
MD5

719e1c7a72d52187767f252c50289d2c
SHA1

f5de47044251f3540bd9075f4b73886dea39d3fc
SHA256

e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f
SHA512

6e7dfd84946a0b54c2f92a0919bdef09e9a0c4a7d7d3cabfef90ee42bc4b5c241c2f9886c971b751f2ecba92d15ae55aeefc8a208d999b6aee293c6aca5037e1
SSDEEP

3072:Z8taVEdolZlknMEVaIWpGZ4ou/q4iY2aVh:FVjl3Fu54o4ou/FBn

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4108	urdvxc.exe
1392	urdvxc.exe
4900	urdvxc.exe
3468	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\njqrsbcq.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\qrhljwvn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\sekbhrbe.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html	urdvxc.exe
File opened for modification	C:\Program Files\GetSearch.mhtml	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\nsstljje.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html	urdvxc.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "qjltlwettntbqrer"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "rhelbqwhkrrlzstr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\lib\\missioncontrol\\features\\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\\nsstljje.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\ = "vjsljjvstrkeltrs"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\lib\\missioncontrol\\features\\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\\njqrsbcq.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\ = "tlebhbkhqrlnqvrl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "lxejhkknqtnqrbvr"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "elehklqejclztqjh"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\ = "vbkhjllszsxeqjxk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{084525A0-95E4-07F0-2D7E-0A02E43AFE2A}\ = "jsqqtllkbnbvqhnj"	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{084525A0-95E4-07F0-2D7E-0A02E43AFE2A}\LocalServer32	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\jre\\sekbhrbe.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{084525A0-95E4-07F0-2D7E-0A02E43AFE2A}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe"	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\db\\qrhljwvn.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}\ = "ntesllcrllscnscb"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}\ = "jlkrhlbvjzzenxhr"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{084525A0-95E4-07F0-2D7E-0A02E43AFE2A}	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\ = "snkbkellbercvnjn"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58F22A6B-E9C1-CE13-9AB2-6E6A8B42D5FD}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17B30228-FEAE-52CE-E831-3379C40FDBE8}	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 4108	3880	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe	83
PID 3880 wrote to memory of 4108	3880	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe	83
PID 3880 wrote to memory of 4108	3880	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe	83
PID 3880 wrote to memory of 1392	3880	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe	84
PID 3880 wrote to memory of 1392	3880	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe	84
PID 3880 wrote to memory of 1392	3880	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe	84
PID 3880 wrote to memory of 3468	3880	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe	86
PID 3880 wrote to memory of 3468	3880	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe	86
PID 3880 wrote to memory of 3468	3880	e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe	86

C:\Users\Admin\AppData\Local\Temp\e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe
"C:\Users\Admin\AppData\Local\Temp\e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:1392
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3468

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:4900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\urdvxc.exe

Filesize
111KB

MD5
719e1c7a72d52187767f252c50289d2c

SHA1
f5de47044251f3540bd9075f4b73886dea39d3fc

SHA256
e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f

SHA512
6e7dfd84946a0b54c2f92a0919bdef09e9a0c4a7d7d3cabfef90ee42bc4b5c241c2f9886c971b751f2ecba92d15ae55aeefc8a208d999b6aee293c6aca5037e1

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
111KB

MD5
719e1c7a72d52187767f252c50289d2c

SHA1
f5de47044251f3540bd9075f4b73886dea39d3fc

SHA256
e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f

SHA512
6e7dfd84946a0b54c2f92a0919bdef09e9a0c4a7d7d3cabfef90ee42bc4b5c241c2f9886c971b751f2ecba92d15ae55aeefc8a208d999b6aee293c6aca5037e1

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
111KB

MD5
719e1c7a72d52187767f252c50289d2c

SHA1
f5de47044251f3540bd9075f4b73886dea39d3fc

SHA256
e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f

SHA512
6e7dfd84946a0b54c2f92a0919bdef09e9a0c4a7d7d3cabfef90ee42bc4b5c241c2f9886c971b751f2ecba92d15ae55aeefc8a208d999b6aee293c6aca5037e1

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
111KB

MD5
719e1c7a72d52187767f252c50289d2c

SHA1
f5de47044251f3540bd9075f4b73886dea39d3fc

SHA256
e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f

SHA512
6e7dfd84946a0b54c2f92a0919bdef09e9a0c4a7d7d3cabfef90ee42bc4b5c241c2f9886c971b751f2ecba92d15ae55aeefc8a208d999b6aee293c6aca5037e1

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
111KB

MD5
719e1c7a72d52187767f252c50289d2c

SHA1
f5de47044251f3540bd9075f4b73886dea39d3fc

SHA256
e9ed516dbefc45326013f64811c8c71cc8577e5a608880351f84b2e098d72f4f

SHA512
6e7dfd84946a0b54c2f92a0919bdef09e9a0c4a7d7d3cabfef90ee42bc4b5c241c2f9886c971b751f2ecba92d15ae55aeefc8a208d999b6aee293c6aca5037e1

Download Submit
memory/1392-142-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/3468-146-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/3880-132-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3880-133-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4108-138-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4108-137-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4900-143-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4900-147-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download