4b424f6352f5d97b7135c611295a4f3df8adf6ce8967273bc2e5e9dd0888e068

General

Target

NEAS.e68a43209df9301b988258eb9aff90b0.exe
Size

119KB
MD5

e68a43209df9301b988258eb9aff90b0
SHA1

21927fdfac050d1d4252d553894c0c22250018f4
SHA256

4b424f6352f5d97b7135c611295a4f3df8adf6ce8967273bc2e5e9dd0888e068
SHA512

5dcdbef541fca400158e435d1639bd229d56d1a1d3226636efcef365d77e0002f80ff2b083490297e02c9f681be2358a14307dd0e502091ae101f15824b369e7
SSDEEP

3072:ICbxzCZQ1HRkHTyTR/OhVMsCQfplOVhUcWWmaa6:/bxziQ1HRk6gVMsffplOUp6

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1176	urdvxc.exe
3016	urdvxc.exe
4900	urdvxc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	NEAS.e68a43209df9301b988258eb9aff90b0.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	NEAS.e68a43209df9301b988258eb9aff90b0.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF84C9FA-0576-5D3C-3CDA-2C4200745826}\ = "rtcnkwjrbzvbctjt"	NEAS.e68a43209df9301b988258eb9aff90b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF84C9FA-0576-5D3C-3CDA-2C4200745826}\LocalServer32	NEAS.e68a43209df9301b988258eb9aff90b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF84C9FA-0576-5D3C-3CDA-2C4200745826}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.e68a43209df9301b988258eb9aff90b0.exe"	NEAS.e68a43209df9301b988258eb9aff90b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BF84C9FA-0576-5D3C-3CDA-2C4200745826}	NEAS.e68a43209df9301b988258eb9aff90b0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "rnzblhrebqbejekh"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bkzwkbjxtkzehjvw"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ekqbexvjrbnhkkbt"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1176	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1176	5100	NEAS.e68a43209df9301b988258eb9aff90b0.exe	94
PID 5100 wrote to memory of 1176	5100	NEAS.e68a43209df9301b988258eb9aff90b0.exe	94
PID 5100 wrote to memory of 1176	5100	NEAS.e68a43209df9301b988258eb9aff90b0.exe	94
PID 5100 wrote to memory of 3016	5100	NEAS.e68a43209df9301b988258eb9aff90b0.exe	95
PID 5100 wrote to memory of 3016	5100	NEAS.e68a43209df9301b988258eb9aff90b0.exe	95
PID 5100 wrote to memory of 3016	5100	NEAS.e68a43209df9301b988258eb9aff90b0.exe	95
PID 5100 wrote to memory of 4900	5100	NEAS.e68a43209df9301b988258eb9aff90b0.exe	96
PID 5100 wrote to memory of 4900	5100	NEAS.e68a43209df9301b988258eb9aff90b0.exe	96
PID 5100 wrote to memory of 4900	5100	NEAS.e68a43209df9301b988258eb9aff90b0.exe	96

C:\Users\Admin\AppData\Local\Temp\NEAS.e68a43209df9301b988258eb9aff90b0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e68a43209df9301b988258eb9aff90b0.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1176
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3016
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.e68a43209df9301b988258eb9aff90b0.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
e68a43209df9301b988258eb9aff90b0

SHA1
21927fdfac050d1d4252d553894c0c22250018f4

SHA256
4b424f6352f5d97b7135c611295a4f3df8adf6ce8967273bc2e5e9dd0888e068

SHA512
5dcdbef541fca400158e435d1639bd229d56d1a1d3226636efcef365d77e0002f80ff2b083490297e02c9f681be2358a14307dd0e502091ae101f15824b369e7

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
e68a43209df9301b988258eb9aff90b0

SHA1
21927fdfac050d1d4252d553894c0c22250018f4

SHA256
4b424f6352f5d97b7135c611295a4f3df8adf6ce8967273bc2e5e9dd0888e068

SHA512
5dcdbef541fca400158e435d1639bd229d56d1a1d3226636efcef365d77e0002f80ff2b083490297e02c9f681be2358a14307dd0e502091ae101f15824b369e7

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
e68a43209df9301b988258eb9aff90b0

SHA1
21927fdfac050d1d4252d553894c0c22250018f4

SHA256
4b424f6352f5d97b7135c611295a4f3df8adf6ce8967273bc2e5e9dd0888e068

SHA512
5dcdbef541fca400158e435d1639bd229d56d1a1d3226636efcef365d77e0002f80ff2b083490297e02c9f681be2358a14307dd0e502091ae101f15824b369e7

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
119KB

MD5
e68a43209df9301b988258eb9aff90b0

SHA1
21927fdfac050d1d4252d553894c0c22250018f4

SHA256
4b424f6352f5d97b7135c611295a4f3df8adf6ce8967273bc2e5e9dd0888e068

SHA512
5dcdbef541fca400158e435d1639bd229d56d1a1d3226636efcef365d77e0002f80ff2b083490297e02c9f681be2358a14307dd0e502091ae101f15824b369e7

Download Submit
memory/1176-12-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/1176-7-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/3016-9-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/4900-11-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/4900-14-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/5100-5-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5100-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5100-1-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/5100-13-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing