Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-11-2023 23:23

General

  • Target

    NEAS.6216f88e5e45a03a7016aa2919ce9980.exe

  • Size

    119KB

  • MD5

    6216f88e5e45a03a7016aa2919ce9980

  • SHA1

    9527454cdcde2ea00a81298e6aaca4e9d339b671

  • SHA256

    3507da801adb04beb52d9f770434a88b7c0760caa44e99da783816d96f61b750

  • SHA512

    abb85ba6434fd1115c1c2af8c4557a4f69e8509a6db7e141d2c285946feeac812afc97eae1cd7ce7134f49ab04ecc4b459cde489efe5d43d6e79ed069f8a3882

  • SSDEEP

    3072:HMYoIVAfOqsjKHTIDxNI6w+8s/Sczqhd7yf3Sh:HMLIDKs7MZh8fa

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Modifies registry class 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.6216f88e5e45a03a7016aa2919ce9980.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6216f88e5e45a03a7016aa2919ce9980.exe"
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /installservice
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:1728
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /start
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:2948
    • C:\Windows\SysWOW64\urdvxc.exe
      C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.6216f88e5e45a03a7016aa2919ce9980.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies registry class
      PID:3348
  • C:\Windows\SysWOW64\urdvxc.exe
    "C:\Windows\SysWOW64\urdvxc.exe" /service
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies registry class
    PID:3912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    119KB

    MD5

    6216f88e5e45a03a7016aa2919ce9980

    SHA1

    9527454cdcde2ea00a81298e6aaca4e9d339b671

    SHA256

    3507da801adb04beb52d9f770434a88b7c0760caa44e99da783816d96f61b750

    SHA512

    abb85ba6434fd1115c1c2af8c4557a4f69e8509a6db7e141d2c285946feeac812afc97eae1cd7ce7134f49ab04ecc4b459cde489efe5d43d6e79ed069f8a3882

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    119KB

    MD5

    6216f88e5e45a03a7016aa2919ce9980

    SHA1

    9527454cdcde2ea00a81298e6aaca4e9d339b671

    SHA256

    3507da801adb04beb52d9f770434a88b7c0760caa44e99da783816d96f61b750

    SHA512

    abb85ba6434fd1115c1c2af8c4557a4f69e8509a6db7e141d2c285946feeac812afc97eae1cd7ce7134f49ab04ecc4b459cde489efe5d43d6e79ed069f8a3882

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    119KB

    MD5

    6216f88e5e45a03a7016aa2919ce9980

    SHA1

    9527454cdcde2ea00a81298e6aaca4e9d339b671

    SHA256

    3507da801adb04beb52d9f770434a88b7c0760caa44e99da783816d96f61b750

    SHA512

    abb85ba6434fd1115c1c2af8c4557a4f69e8509a6db7e141d2c285946feeac812afc97eae1cd7ce7134f49ab04ecc4b459cde489efe5d43d6e79ed069f8a3882

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    119KB

    MD5

    6216f88e5e45a03a7016aa2919ce9980

    SHA1

    9527454cdcde2ea00a81298e6aaca4e9d339b671

    SHA256

    3507da801adb04beb52d9f770434a88b7c0760caa44e99da783816d96f61b750

    SHA512

    abb85ba6434fd1115c1c2af8c4557a4f69e8509a6db7e141d2c285946feeac812afc97eae1cd7ce7134f49ab04ecc4b459cde489efe5d43d6e79ed069f8a3882

  • C:\Windows\SysWOW64\urdvxc.exe

    Filesize

    119KB

    MD5

    6216f88e5e45a03a7016aa2919ce9980

    SHA1

    9527454cdcde2ea00a81298e6aaca4e9d339b671

    SHA256

    3507da801adb04beb52d9f770434a88b7c0760caa44e99da783816d96f61b750

    SHA512

    abb85ba6434fd1115c1c2af8c4557a4f69e8509a6db7e141d2c285946feeac812afc97eae1cd7ce7134f49ab04ecc4b459cde489efe5d43d6e79ed069f8a3882

  • memory/1728-8-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/1728-7-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/1728-6-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/2948-10-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/2948-13-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/3348-35-0x00000000001C0000-0x00000000001DF000-memory.dmp

    Filesize

    124KB

  • memory/3512-32-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3512-0-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/3512-1-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-43-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-50-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-21-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-22-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-23-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-24-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-25-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-26-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-27-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-28-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-29-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-30-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-31-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-17-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-15-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-34-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-14-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-36-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-37-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-38-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-39-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-40-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-41-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-42-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-12-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-44-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-45-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-46-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-47-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-48-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-49-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-20-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-51-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-52-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-53-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-54-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-55-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-56-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-57-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-58-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-59-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-60-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-61-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-62-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-63-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-64-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-65-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-66-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-67-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-68-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-69-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-70-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-71-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-72-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-73-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-74-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-75-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-76-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-77-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-78-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-79-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-80-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB

  • memory/3912-1154-0x00000000001E0000-0x00000000001FF000-memory.dmp

    Filesize

    124KB