07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e

General

Target

07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe
Size

121KB
MD5

587f4c259d124474776dd66952018100
SHA1

669f1d4aae3b9474984de78c2a68d13381714cf0
SHA256

07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e
SHA512

1d12e8a1d71fc97a8d98472aba5107548efa22311368f23ca515ebe5591892d2bcffc833cbd79995a1aad43747dc81f121cef0522208b796a7795c5001c06b1e
SSDEEP

3072:68rCRf4E2SG3NGfE7ZuZoHrvIScj3znsdfTSD1GAQz:bG8SENG87ZuiHrvZcfnsdff

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4716	urdvxc.exe
4696	urdvxc.exe
4816	urdvxc.exe
3076	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "htjrhvwestrnzrtt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F987437A-3896-52A5-C3F2-220B828B313B}\ = "nswjwebxcejlnhll"	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F987437A-3896-52A5-C3F2-220B828B313B}\LocalServer32	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bbtrhnrrhlrweteq"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F987437A-3896-52A5-C3F2-220B828B313B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe"	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ewcljxtbjnbsrcln"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ththkwehwnzrreth"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F987437A-3896-52A5-C3F2-220B828B313B}	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4716	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 4716	4100	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe	82
PID 4100 wrote to memory of 4716	4100	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe	82
PID 4100 wrote to memory of 4716	4100	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe	82
PID 4100 wrote to memory of 4696	4100	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe	83
PID 4100 wrote to memory of 4696	4100	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe	83
PID 4100 wrote to memory of 4696	4100	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe	83
PID 4100 wrote to memory of 4816	4100	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe	84
PID 4100 wrote to memory of 4816	4100	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe	84
PID 4100 wrote to memory of 4816	4100	07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe	84

C:\Users\Admin\AppData\Local\Temp\07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe
"C:\Users\Admin\AppData\Local\Temp\07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4716
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4696
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4816

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:3076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\urdvxc.exe

Filesize
121KB

MD5
587f4c259d124474776dd66952018100

SHA1
669f1d4aae3b9474984de78c2a68d13381714cf0

SHA256
07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e

SHA512
1d12e8a1d71fc97a8d98472aba5107548efa22311368f23ca515ebe5591892d2bcffc833cbd79995a1aad43747dc81f121cef0522208b796a7795c5001c06b1e

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
121KB

MD5
587f4c259d124474776dd66952018100

SHA1
669f1d4aae3b9474984de78c2a68d13381714cf0

SHA256
07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e

SHA512
1d12e8a1d71fc97a8d98472aba5107548efa22311368f23ca515ebe5591892d2bcffc833cbd79995a1aad43747dc81f121cef0522208b796a7795c5001c06b1e

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
121KB

MD5
587f4c259d124474776dd66952018100

SHA1
669f1d4aae3b9474984de78c2a68d13381714cf0

SHA256
07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e

SHA512
1d12e8a1d71fc97a8d98472aba5107548efa22311368f23ca515ebe5591892d2bcffc833cbd79995a1aad43747dc81f121cef0522208b796a7795c5001c06b1e

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
121KB

MD5
587f4c259d124474776dd66952018100

SHA1
669f1d4aae3b9474984de78c2a68d13381714cf0

SHA256
07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e

SHA512
1d12e8a1d71fc97a8d98472aba5107548efa22311368f23ca515ebe5591892d2bcffc833cbd79995a1aad43747dc81f121cef0522208b796a7795c5001c06b1e

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
121KB

MD5
587f4c259d124474776dd66952018100

SHA1
669f1d4aae3b9474984de78c2a68d13381714cf0

SHA256
07005197230ab70a336ccf546708bd89bd3913033bd6080b5e15dd90739daf5e

SHA512
1d12e8a1d71fc97a8d98472aba5107548efa22311368f23ca515ebe5591892d2bcffc833cbd79995a1aad43747dc81f121cef0522208b796a7795c5001c06b1e

Download Submit
memory/3076-145-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/3076-146-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4100-135-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4696-143-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/4716-136-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4716-142-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4816-144-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing