Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2023, 02:50

General

  • Target

    NEAS.72d32be464da5280a3e906c9dd63d1b0.exe

  • Size

    119KB

  • MD5

    72d32be464da5280a3e906c9dd63d1b0

  • SHA1

    cc351c5b97f63d3692ad4ca5f067b94375d549ac

  • SHA256

    3cc8595e40000bfc1949b41e274f1efb05101e876fa393c0eaf1e714984c6e28

  • SHA512

    bb6abda605f6abda13e0931d101524fe4375b84a8e8a0370dbd082ba17b9e01da55893ceb864c014500f185ea46abcd122136b9db302cb8787165534703fd1f4

  • SSDEEP

    1536:7c/ge7U8XmXznTRsqpjdFd7tWRs1A4ia8rtNkj7CsQtxTElfYJecpECx9tnc3Y8R:7c4e7HXc5dFdZAFa8vwQbTCYHpVcr

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 36 IoCs
  • Modifies registry class 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.72d32be464da5280a3e906c9dd63d1b0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.72d32be464da5280a3e906c9dd63d1b0.exe"
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /installservice
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4612
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /start
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:3676
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.72d32be464da5280a3e906c9dd63d1b0.exe
      2⤵
        PID:3452
    • C:\Windows\SysWOW64\urdvxc.exe
      "C:\Windows\SysWOW64\urdvxc.exe" /service
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Modifies registry class
      PID:1880
    • C:\Windows\system32\backgroundTaskHost.exe
      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
      1⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies registry class
      PID:3452

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\urdvxc.exe

      Filesize

      119KB

      MD5

      72d32be464da5280a3e906c9dd63d1b0

      SHA1

      cc351c5b97f63d3692ad4ca5f067b94375d549ac

      SHA256

      3cc8595e40000bfc1949b41e274f1efb05101e876fa393c0eaf1e714984c6e28

      SHA512

      bb6abda605f6abda13e0931d101524fe4375b84a8e8a0370dbd082ba17b9e01da55893ceb864c014500f185ea46abcd122136b9db302cb8787165534703fd1f4

    • C:\Windows\SysWOW64\urdvxc.exe

      Filesize

      119KB

      MD5

      72d32be464da5280a3e906c9dd63d1b0

      SHA1

      cc351c5b97f63d3692ad4ca5f067b94375d549ac

      SHA256

      3cc8595e40000bfc1949b41e274f1efb05101e876fa393c0eaf1e714984c6e28

      SHA512

      bb6abda605f6abda13e0931d101524fe4375b84a8e8a0370dbd082ba17b9e01da55893ceb864c014500f185ea46abcd122136b9db302cb8787165534703fd1f4

    • C:\Windows\SysWOW64\urdvxc.exe

      Filesize

      119KB

      MD5

      72d32be464da5280a3e906c9dd63d1b0

      SHA1

      cc351c5b97f63d3692ad4ca5f067b94375d549ac

      SHA256

      3cc8595e40000bfc1949b41e274f1efb05101e876fa393c0eaf1e714984c6e28

      SHA512

      bb6abda605f6abda13e0931d101524fe4375b84a8e8a0370dbd082ba17b9e01da55893ceb864c014500f185ea46abcd122136b9db302cb8787165534703fd1f4

    • C:\Windows\SysWOW64\urdvxc.exe

      Filesize

      119KB

      MD5

      72d32be464da5280a3e906c9dd63d1b0

      SHA1

      cc351c5b97f63d3692ad4ca5f067b94375d549ac

      SHA256

      3cc8595e40000bfc1949b41e274f1efb05101e876fa393c0eaf1e714984c6e28

      SHA512

      bb6abda605f6abda13e0931d101524fe4375b84a8e8a0370dbd082ba17b9e01da55893ceb864c014500f185ea46abcd122136b9db302cb8787165534703fd1f4

    • C:\Windows\SysWOW64\urdvxc.exe

      Filesize

      119KB

      MD5

      72d32be464da5280a3e906c9dd63d1b0

      SHA1

      cc351c5b97f63d3692ad4ca5f067b94375d549ac

      SHA256

      3cc8595e40000bfc1949b41e274f1efb05101e876fa393c0eaf1e714984c6e28

      SHA512

      bb6abda605f6abda13e0931d101524fe4375b84a8e8a0370dbd082ba17b9e01da55893ceb864c014500f185ea46abcd122136b9db302cb8787165534703fd1f4

    • memory/1880-57-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-56-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-13-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-14-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-1127-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-23-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-24-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-26-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-27-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-28-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-29-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-31-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-30-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-32-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-34-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-35-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-36-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-38-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-39-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-40-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-41-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-42-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-43-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-44-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-46-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-45-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-47-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-49-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-50-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-52-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-53-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-54-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-61-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-20-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-12-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-60-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-78-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-64-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-65-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-66-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-68-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-69-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-71-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-72-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-73-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-75-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-76-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-77-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-79-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-63-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-74-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-70-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-67-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-62-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-59-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-58-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-55-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-51-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-48-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-37-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-33-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-25-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/1880-21-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/3452-22-0x00000000001C0000-0x00000000001DF000-memory.dmp

      Filesize

      124KB

    • memory/3676-10-0x00000000001C0000-0x00000000001DF000-memory.dmp

      Filesize

      124KB

    • memory/4612-8-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/4612-7-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/4612-6-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/4740-0-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/4740-1-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB

    • memory/4740-19-0x00000000001E0000-0x00000000001FF000-memory.dmp

      Filesize

      124KB