20aa6b4fdd3afea228688a47def24fcc30b129defe49ce96f5fdd82ba1777e65

General

Target

NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe
Size

119KB
MD5

dda3cf7adc50b574bb93d184e7fa3c80
SHA1

9fcf2548216736a10e29f6de940b84fffefcce11
SHA256

20aa6b4fdd3afea228688a47def24fcc30b129defe49ce96f5fdd82ba1777e65
SHA512

623eaccd776d292456f1d08a5eb2afb4bbeec584e097157c51926bbd1a745603d651b42e689908b1bf7618f30f2739c4d6a7d9096505fb5196de76636d933518
SSDEEP

3072:8MpKZrFJpFGNkWseyDzjEZ2a7/KsVf2qtns7z:50ZNUklXj/a7/KsdPts7z

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4588	urdvxc.exe

Executes dropped EXE 3 IoCs

pid	Process
2304	urdvxc.exe
1512	urdvxc.exe
4588	urdvxc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3DDB69-F355-2249-BE4F-204494197F99}\LocalServer32	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "qbsrhjstltnbrnbh"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3DDB69-F355-2249-BE4F-204494197F99}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe"	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "hhreskthnwjetzxl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "blhhrrlhkvlnlkcb"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3DDB69-F355-2249-BE4F-204494197F99}	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED3DDB69-F355-2249-BE4F-204494197F99}\ = "zeqzjetvkczwskvl"	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 2304	3812	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe	90
PID 3812 wrote to memory of 2304	3812	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe	90
PID 3812 wrote to memory of 2304	3812	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe	90
PID 3812 wrote to memory of 1512	3812	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe	91
PID 3812 wrote to memory of 1512	3812	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe	91
PID 3812 wrote to memory of 1512	3812	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe	91
PID 3812 wrote to memory of 4588	3812	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe	93
PID 3812 wrote to memory of 4588	3812	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe	93
PID 3812 wrote to memory of 4588	3812	NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:1512
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.dda3cf7adc50b574bb93d184e7fa3c80.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:4588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
dda3cf7adc50b574bb93d184e7fa3c80

SHA1
9fcf2548216736a10e29f6de940b84fffefcce11

SHA256
20aa6b4fdd3afea228688a47def24fcc30b129defe49ce96f5fdd82ba1777e65

SHA512
623eaccd776d292456f1d08a5eb2afb4bbeec584e097157c51926bbd1a745603d651b42e689908b1bf7618f30f2739c4d6a7d9096505fb5196de76636d933518

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
dda3cf7adc50b574bb93d184e7fa3c80

SHA1
9fcf2548216736a10e29f6de940b84fffefcce11

SHA256
20aa6b4fdd3afea228688a47def24fcc30b129defe49ce96f5fdd82ba1777e65

SHA512
623eaccd776d292456f1d08a5eb2afb4bbeec584e097157c51926bbd1a745603d651b42e689908b1bf7618f30f2739c4d6a7d9096505fb5196de76636d933518

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
dda3cf7adc50b574bb93d184e7fa3c80

SHA1
9fcf2548216736a10e29f6de940b84fffefcce11

SHA256
20aa6b4fdd3afea228688a47def24fcc30b129defe49ce96f5fdd82ba1777e65

SHA512
623eaccd776d292456f1d08a5eb2afb4bbeec584e097157c51926bbd1a745603d651b42e689908b1bf7618f30f2739c4d6a7d9096505fb5196de76636d933518

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
dda3cf7adc50b574bb93d184e7fa3c80

SHA1
9fcf2548216736a10e29f6de940b84fffefcce11

SHA256
20aa6b4fdd3afea228688a47def24fcc30b129defe49ce96f5fdd82ba1777e65

SHA512
623eaccd776d292456f1d08a5eb2afb4bbeec584e097157c51926bbd1a745603d651b42e689908b1bf7618f30f2739c4d6a7d9096505fb5196de76636d933518

Download Submit
memory/1512-10-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/2304-11-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/2304-13-0x0000000000440000-0x000000000045F000-memory.dmp

Filesize
124KB

Download
memory/3812-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3812-1-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/3812-6-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3812-8-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4588-12-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing