Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2023 23:23
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.6216f88e5e45a03a7016aa2919ce9980.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.6216f88e5e45a03a7016aa2919ce9980.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.6216f88e5e45a03a7016aa2919ce9980.exe
-
Size
119KB
-
MD5
6216f88e5e45a03a7016aa2919ce9980
-
SHA1
9527454cdcde2ea00a81298e6aaca4e9d339b671
-
SHA256
3507da801adb04beb52d9f770434a88b7c0760caa44e99da783816d96f61b750
-
SHA512
abb85ba6434fd1115c1c2af8c4557a4f69e8509a6db7e141d2c285946feeac812afc97eae1cd7ce7134f49ab04ecc4b459cde489efe5d43d6e79ed069f8a3882
-
SSDEEP
3072:HMYoIVAfOqsjKHTIDxNI6w+8s/Sczqhd7yf3Sh:HMLIDKs7MZh8fa
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3348 urdvxc.exe -
Executes dropped EXE 4 IoCs
pid Process 1728 urdvxc.exe 2948 urdvxc.exe 3912 urdvxc.exe 3348 urdvxc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\urdvxc.exe NEAS.6216f88e5e45a03a7016aa2919ce9980.exe File opened for modification C:\Windows\SysWOW64\urdvxc.exe NEAS.6216f88e5e45a03a7016aa2919ce9980.exe File created C:\Windows\SysWOW64\urdvxc.exe urdvxc.exe -
Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\chllsvtv.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM urdvxc.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\Welcome.html urdvxc.exe File opened for modification C:\Program Files\Java\jre-1.8\hcjzqenb.exe urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM urdvxc.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe urdvxc.exe -
Modifies registry class 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27D16CB1-C481-FD85-971A-9F641D2E36C6} NEAS.6216f88e5e45a03a7016aa2919ce9980.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "crbjnnbbsxwqqekc" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27D16CB1-C481-FD85-971A-9F641D2E36C6}\ = "rclqehqteehlteew" NEAS.6216f88e5e45a03a7016aa2919ce9980.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ekrkhrhrcnrlnksq" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bwlettretkhewtbn" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "xxxsbhjtjrrlejcc" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "herqjnbtckvhkcrl" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "ezltlbhlxjwjlshh" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32 urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27D16CB1-C481-FD85-971A-9F641D2E36C6}\LocalServer32 NEAS.6216f88e5e45a03a7016aa2919ce9980.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27D16CB1-C481-FD85-971A-9F641D2E36C6}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.6216f88e5e45a03a7016aa2919ce9980.exe" NEAS.6216f88e5e45a03a7016aa2919ce9980.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "jhztxhescrtwqhnv" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32 urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "lhbebbbwhnstsbbz" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564} urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84} urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "klrhsjkcbxtztblt" urdvxc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe" urdvxc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32 urdvxc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1728 urdvxc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3512 wrote to memory of 1728 3512 NEAS.6216f88e5e45a03a7016aa2919ce9980.exe 88 PID 3512 wrote to memory of 1728 3512 NEAS.6216f88e5e45a03a7016aa2919ce9980.exe 88 PID 3512 wrote to memory of 1728 3512 NEAS.6216f88e5e45a03a7016aa2919ce9980.exe 88 PID 3512 wrote to memory of 2948 3512 NEAS.6216f88e5e45a03a7016aa2919ce9980.exe 90 PID 3512 wrote to memory of 2948 3512 NEAS.6216f88e5e45a03a7016aa2919ce9980.exe 90 PID 3512 wrote to memory of 2948 3512 NEAS.6216f88e5e45a03a7016aa2919ce9980.exe 90 PID 3512 wrote to memory of 3348 3512 NEAS.6216f88e5e45a03a7016aa2919ce9980.exe 93 PID 3512 wrote to memory of 3348 3512 NEAS.6216f88e5e45a03a7016aa2919ce9980.exe 93 PID 3512 wrote to memory of 3348 3512 NEAS.6216f88e5e45a03a7016aa2919ce9980.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6216f88e5e45a03a7016aa2919ce9980.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6216f88e5e45a03a7016aa2919ce9980.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /installservice2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /start2⤵
- Executes dropped EXE
- Modifies registry class
PID:2948
-
-
C:\Windows\SysWOW64\urdvxc.exeC:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\NEAS.6216f88e5e45a03a7016aa2919ce9980.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies registry class
PID:3348
-
-
C:\Windows\SysWOW64\urdvxc.exe"C:\Windows\SysWOW64\urdvxc.exe" /service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:3912
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD56216f88e5e45a03a7016aa2919ce9980
SHA19527454cdcde2ea00a81298e6aaca4e9d339b671
SHA2563507da801adb04beb52d9f770434a88b7c0760caa44e99da783816d96f61b750
SHA512abb85ba6434fd1115c1c2af8c4557a4f69e8509a6db7e141d2c285946feeac812afc97eae1cd7ce7134f49ab04ecc4b459cde489efe5d43d6e79ed069f8a3882
-
Filesize
119KB
MD56216f88e5e45a03a7016aa2919ce9980
SHA19527454cdcde2ea00a81298e6aaca4e9d339b671
SHA2563507da801adb04beb52d9f770434a88b7c0760caa44e99da783816d96f61b750
SHA512abb85ba6434fd1115c1c2af8c4557a4f69e8509a6db7e141d2c285946feeac812afc97eae1cd7ce7134f49ab04ecc4b459cde489efe5d43d6e79ed069f8a3882
-
Filesize
119KB
MD56216f88e5e45a03a7016aa2919ce9980
SHA19527454cdcde2ea00a81298e6aaca4e9d339b671
SHA2563507da801adb04beb52d9f770434a88b7c0760caa44e99da783816d96f61b750
SHA512abb85ba6434fd1115c1c2af8c4557a4f69e8509a6db7e141d2c285946feeac812afc97eae1cd7ce7134f49ab04ecc4b459cde489efe5d43d6e79ed069f8a3882
-
Filesize
119KB
MD56216f88e5e45a03a7016aa2919ce9980
SHA19527454cdcde2ea00a81298e6aaca4e9d339b671
SHA2563507da801adb04beb52d9f770434a88b7c0760caa44e99da783816d96f61b750
SHA512abb85ba6434fd1115c1c2af8c4557a4f69e8509a6db7e141d2c285946feeac812afc97eae1cd7ce7134f49ab04ecc4b459cde489efe5d43d6e79ed069f8a3882
-
Filesize
119KB
MD56216f88e5e45a03a7016aa2919ce9980
SHA19527454cdcde2ea00a81298e6aaca4e9d339b671
SHA2563507da801adb04beb52d9f770434a88b7c0760caa44e99da783816d96f61b750
SHA512abb85ba6434fd1115c1c2af8c4557a4f69e8509a6db7e141d2c285946feeac812afc97eae1cd7ce7134f49ab04ecc4b459cde489efe5d43d6e79ed069f8a3882