27d5214bdf7eeae0a8b9ed39b158573c296df5676baafda26787cc14110cdd5e

General

Target

4abbaf3ff1e22fe75bec4a1acecbca2f.exe
Size

100KB
MD5

4abbaf3ff1e22fe75bec4a1acecbca2f
SHA1

ab4cf28561986e6eb1049e624e2cea5385cdb820
SHA256

27d5214bdf7eeae0a8b9ed39b158573c296df5676baafda26787cc14110cdd5e
SHA512

cbc2c60121fb5a9e87b7cdb9c77892a6cf045eda5b935b54e1be7a7c7c9ba8fac6be080a6e0342c94940e641efee10b78d2f6424391267718618c8348c86256a
SSDEEP

1536:CFo+gaxzVZwTKcP0tucVdkjj9N2odeKuuJZTfA0zj2JZnW6pBp:yo+gaJDwT3M3dYbdeKhvBoJjp

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
8	urdvxc.exe
456	urdvxc.exe
404	urdvxc.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	4abbaf3ff1e22fe75bec4a1acecbca2f.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	4abbaf3ff1e22fe75bec4a1acecbca2f.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBA72B22-E9A0-BD4F-CE2F-C7ADD497A3BD}\LocalServer32	4abbaf3ff1e22fe75bec4a1acecbca2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bnecbvvhbekjksht"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBA72B22-E9A0-BD4F-CE2F-C7ADD497A3BD}	4abbaf3ff1e22fe75bec4a1acecbca2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ssljbsknjkqlszzc"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBA72B22-E9A0-BD4F-CE2F-C7ADD497A3BD}\ = "wbkxwebslewbjkwj"	4abbaf3ff1e22fe75bec4a1acecbca2f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBA72B22-E9A0-BD4F-CE2F-C7ADD497A3BD}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4abbaf3ff1e22fe75bec4a1acecbca2f.exe"	4abbaf3ff1e22fe75bec4a1acecbca2f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "kezllrrnhnbjnjbn"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 8	1952	4abbaf3ff1e22fe75bec4a1acecbca2f.exe	94
PID 1952 wrote to memory of 8	1952	4abbaf3ff1e22fe75bec4a1acecbca2f.exe	94
PID 1952 wrote to memory of 8	1952	4abbaf3ff1e22fe75bec4a1acecbca2f.exe	94
PID 1952 wrote to memory of 456	1952	4abbaf3ff1e22fe75bec4a1acecbca2f.exe	95
PID 1952 wrote to memory of 456	1952	4abbaf3ff1e22fe75bec4a1acecbca2f.exe	95
PID 1952 wrote to memory of 456	1952	4abbaf3ff1e22fe75bec4a1acecbca2f.exe	95
PID 1952 wrote to memory of 404	1952	4abbaf3ff1e22fe75bec4a1acecbca2f.exe	96
PID 1952 wrote to memory of 404	1952	4abbaf3ff1e22fe75bec4a1acecbca2f.exe	96
PID 1952 wrote to memory of 404	1952	4abbaf3ff1e22fe75bec4a1acecbca2f.exe	96

C:\Users\Admin\AppData\Local\Temp\4abbaf3ff1e22fe75bec4a1acecbca2f.exe
"C:\Users\Admin\AppData\Local\Temp\4abbaf3ff1e22fe75bec4a1acecbca2f.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:8
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:456
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\4abbaf3ff1e22fe75bec4a1acecbca2f.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\urdvxc.exe

Filesize
100KB

MD5
4abbaf3ff1e22fe75bec4a1acecbca2f

SHA1
ab4cf28561986e6eb1049e624e2cea5385cdb820

SHA256
27d5214bdf7eeae0a8b9ed39b158573c296df5676baafda26787cc14110cdd5e

SHA512
cbc2c60121fb5a9e87b7cdb9c77892a6cf045eda5b935b54e1be7a7c7c9ba8fac6be080a6e0342c94940e641efee10b78d2f6424391267718618c8348c86256a

Download Submit
memory/8-6-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/8-14-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/404-10-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/404-11-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/404-12-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/456-8-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/1952-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1952-1-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/1952-13-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing