98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13

General

Target

98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe
Size

63KB
MD5

5db8b832e22484d66ce5f9ca8b2e93b4
SHA1

0fb01884f09a57d7731f563e9b3026e4383f5426
SHA256

98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13
SHA512

8e946fa5350652248fb14f751f7508df68c131ccd58c9642303821d0fc7ccaab4dcd80d193e9d817de86b43a4a6513118a242b0d9a63ca4d963f3d1286c224bc
SSDEEP

1536:JTWjFL/0OTdy5nU3bKrSX75u2zESL/MkQbtMQCyRnJUTrKZxhmSf8u1GREPevk:JcB/0ORAnU5u2zENbbtLfBZe21G+2vk

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4620	urdvxc.exe
1020	urdvxc.exe
116	urdvxc.exe
3580	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\qrhljwvn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\sekbhrbe.exe	urdvxc.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E2BFEB1-E0CC-E8CB-821B-71FC2C98984C}\ = "eksjbnjbkzjhjnkk"	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ntwrhbcvlzjbrces"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\jre\\sekbhrbe.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\db\\qrhljwvn.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\ = "xrteecrxwnvtkcxe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E2BFEB1-E0CC-E8CB-821B-71FC2C98984C}	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E2BFEB1-E0CC-E8CB-821B-71FC2C98984C}\LocalServer32	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\ = "rlthzseectckskzc"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ccqetberntcrxkjv"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E2BFEB1-E0CC-E8CB-821B-71FC2C98984C}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe"	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "skstenjnnlktjcjr"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "hsxhlcjwtvcttjnb"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4620	4088	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe	83
PID 4088 wrote to memory of 4620	4088	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe	83
PID 4088 wrote to memory of 4620	4088	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe	83
PID 4088 wrote to memory of 1020	4088	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe	84
PID 4088 wrote to memory of 1020	4088	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe	84
PID 4088 wrote to memory of 1020	4088	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe	84
PID 4088 wrote to memory of 3580	4088	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe	86
PID 4088 wrote to memory of 3580	4088	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe	86
PID 4088 wrote to memory of 3580	4088	98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe	86

C:\Users\Admin\AppData\Local\Temp\98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe
"C:\Users\Admin\AppData\Local\Temp\98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:1020
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3580

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:116

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\urdvxc.exe

Filesize
63KB

MD5
5db8b832e22484d66ce5f9ca8b2e93b4

SHA1
0fb01884f09a57d7731f563e9b3026e4383f5426

SHA256
98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13

SHA512
8e946fa5350652248fb14f751f7508df68c131ccd58c9642303821d0fc7ccaab4dcd80d193e9d817de86b43a4a6513118a242b0d9a63ca4d963f3d1286c224bc

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
63KB

MD5
5db8b832e22484d66ce5f9ca8b2e93b4

SHA1
0fb01884f09a57d7731f563e9b3026e4383f5426

SHA256
98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13

SHA512
8e946fa5350652248fb14f751f7508df68c131ccd58c9642303821d0fc7ccaab4dcd80d193e9d817de86b43a4a6513118a242b0d9a63ca4d963f3d1286c224bc

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
63KB

MD5
5db8b832e22484d66ce5f9ca8b2e93b4

SHA1
0fb01884f09a57d7731f563e9b3026e4383f5426

SHA256
98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13

SHA512
8e946fa5350652248fb14f751f7508df68c131ccd58c9642303821d0fc7ccaab4dcd80d193e9d817de86b43a4a6513118a242b0d9a63ca4d963f3d1286c224bc

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
63KB

MD5
5db8b832e22484d66ce5f9ca8b2e93b4

SHA1
0fb01884f09a57d7731f563e9b3026e4383f5426

SHA256
98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13

SHA512
8e946fa5350652248fb14f751f7508df68c131ccd58c9642303821d0fc7ccaab4dcd80d193e9d817de86b43a4a6513118a242b0d9a63ca4d963f3d1286c224bc

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
63KB

MD5
5db8b832e22484d66ce5f9ca8b2e93b4

SHA1
0fb01884f09a57d7731f563e9b3026e4383f5426

SHA256
98b87669b893d35a4636913424e7ba87f2c1947407f3d1c81dd9a86165d45d13

SHA512
8e946fa5350652248fb14f751f7508df68c131ccd58c9642303821d0fc7ccaab4dcd80d193e9d817de86b43a4a6513118a242b0d9a63ca4d963f3d1286c224bc

Download Submit
memory/116-146-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/116-142-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/1020-138-0x0000000000000000-mapping.dmp

Download
memory/1020-141-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/3580-143-0x0000000000000000-mapping.dmp

Download
memory/3580-145-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/4088-132-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4088-133-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4620-137-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4620-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing