584b5b16bb27781fbd6c5506e6853e6009fd6df7507dd1abfd8fdc89bde65439

Analysis

max time kernel
44s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.5d322b652f9dfac13740784615dea550.exe
Size

119KB
MD5

5d322b652f9dfac13740784615dea550
SHA1

bdf6e182455bbe09a81b8ec1e2e8b4493b9d1844
SHA256

584b5b16bb27781fbd6c5506e6853e6009fd6df7507dd1abfd8fdc89bde65439
SHA512

273642a39bd9ccb4bc5323f47f1c474fd9aab3089ba754ca1df9327267f824b03b07dc814b0e71f2d40fc2abb21d61582b4c3dbf84b365178623fe3ae507911a
SSDEEP

1536:c1T/gWD0R8jMg0awOiqgTziEC6zaGAtrHXOH+irOaTGL6EBmY8pt4/TBDFcfr4ZY:+/gQ0rgNi1zN9ABU+Ms4gvcT4vX0zGA

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3796	urdvxc.exe

Executes dropped EXE 4 IoCs

pid	Process
4988	urdvxc.exe
440	urdvxc.exe
4020	urdvxc.exe
3796	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	NEAS.5d322b652f9dfac13740784615dea550.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	NEAS.5d322b652f9dfac13740784615dea550.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "jwrnsjjkkqwksjkr"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EA5578E-6CEF-ED10-DA13-219C8A2473A6}	NEAS.5d322b652f9dfac13740784615dea550.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "nbvtqtwkhcelhhxe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "nlehljhnbnhjexew"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "szrvvbjqlhrqneqr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "wbznhejvchsrvsre"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EA5578E-6CEF-ED10-DA13-219C8A2473A6}\ = "celbhszlhvezqkkx"	NEAS.5d322b652f9dfac13740784615dea550.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EA5578E-6CEF-ED10-DA13-219C8A2473A6}\LocalServer32	NEAS.5d322b652f9dfac13740784615dea550.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EA5578E-6CEF-ED10-DA13-219C8A2473A6}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.5d322b652f9dfac13740784615dea550.exe"	NEAS.5d322b652f9dfac13740784615dea550.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "tclnhskethchjttb"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 772 wrote to memory of 4988	772	NEAS.5d322b652f9dfac13740784615dea550.exe	87
PID 772 wrote to memory of 4988	772	NEAS.5d322b652f9dfac13740784615dea550.exe	87
PID 772 wrote to memory of 4988	772	NEAS.5d322b652f9dfac13740784615dea550.exe	87
PID 772 wrote to memory of 440	772	NEAS.5d322b652f9dfac13740784615dea550.exe	88
PID 772 wrote to memory of 440	772	NEAS.5d322b652f9dfac13740784615dea550.exe	88
PID 772 wrote to memory of 440	772	NEAS.5d322b652f9dfac13740784615dea550.exe	88
PID 772 wrote to memory of 3796	772	NEAS.5d322b652f9dfac13740784615dea550.exe	93
PID 772 wrote to memory of 3796	772	NEAS.5d322b652f9dfac13740784615dea550.exe	93
PID 772 wrote to memory of 3796	772	NEAS.5d322b652f9dfac13740784615dea550.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.5d322b652f9dfac13740784615dea550.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5d322b652f9dfac13740784615dea550.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:440
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.5d322b652f9dfac13740784615dea550.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:3796

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:4020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
5d322b652f9dfac13740784615dea550

SHA1
bdf6e182455bbe09a81b8ec1e2e8b4493b9d1844

SHA256
584b5b16bb27781fbd6c5506e6853e6009fd6df7507dd1abfd8fdc89bde65439

SHA512
273642a39bd9ccb4bc5323f47f1c474fd9aab3089ba754ca1df9327267f824b03b07dc814b0e71f2d40fc2abb21d61582b4c3dbf84b365178623fe3ae507911a

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
5d322b652f9dfac13740784615dea550

SHA1
bdf6e182455bbe09a81b8ec1e2e8b4493b9d1844

SHA256
584b5b16bb27781fbd6c5506e6853e6009fd6df7507dd1abfd8fdc89bde65439

SHA512
273642a39bd9ccb4bc5323f47f1c474fd9aab3089ba754ca1df9327267f824b03b07dc814b0e71f2d40fc2abb21d61582b4c3dbf84b365178623fe3ae507911a

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
5d322b652f9dfac13740784615dea550

SHA1
bdf6e182455bbe09a81b8ec1e2e8b4493b9d1844

SHA256
584b5b16bb27781fbd6c5506e6853e6009fd6df7507dd1abfd8fdc89bde65439

SHA512
273642a39bd9ccb4bc5323f47f1c474fd9aab3089ba754ca1df9327267f824b03b07dc814b0e71f2d40fc2abb21d61582b4c3dbf84b365178623fe3ae507911a

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
5d322b652f9dfac13740784615dea550

SHA1
bdf6e182455bbe09a81b8ec1e2e8b4493b9d1844

SHA256
584b5b16bb27781fbd6c5506e6853e6009fd6df7507dd1abfd8fdc89bde65439

SHA512
273642a39bd9ccb4bc5323f47f1c474fd9aab3089ba754ca1df9327267f824b03b07dc814b0e71f2d40fc2abb21d61582b4c3dbf84b365178623fe3ae507911a

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
5d322b652f9dfac13740784615dea550

SHA1
bdf6e182455bbe09a81b8ec1e2e8b4493b9d1844

SHA256
584b5b16bb27781fbd6c5506e6853e6009fd6df7507dd1abfd8fdc89bde65439

SHA512
273642a39bd9ccb4bc5323f47f1c474fd9aab3089ba754ca1df9327267f824b03b07dc814b0e71f2d40fc2abb21d61582b4c3dbf84b365178623fe3ae507911a

Download Submit
memory/440-10-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/772-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/772-1-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/772-24-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/3796-26-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/4020-43-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-48-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-14-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-18-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-17-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-20-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-21-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-12-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-337-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-23-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-25-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-79-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-27-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-28-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-29-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-30-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-31-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-32-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-33-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-34-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-35-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-36-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-37-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-38-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-39-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-40-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-41-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-42-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-78-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-44-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-45-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-46-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-47-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-13-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-49-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-50-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-51-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-52-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-53-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-54-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-55-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-56-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-57-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-58-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-59-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-60-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-61-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-62-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-63-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-64-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-65-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-66-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-67-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-68-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-69-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-70-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-71-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-72-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-73-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-74-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-75-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-76-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4020-77-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/4988-6-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4988-9-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4988-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download