3b5b2300339fd2ff82f0dc567115d595a858bf0c17108629d9770e6d010b0ee3

General

Target

3b5b2300339fd2ff82f0dc567115d595a858bf0c17108629d9770e6d010b0ee3.dll
Size

708KB
MD5

092579157a64a40e4e51800705290d4a
SHA1

c2e71a77d11a18b685295b09c3b5c63e831f7033
SHA256

3b5b2300339fd2ff82f0dc567115d595a858bf0c17108629d9770e6d010b0ee3
SHA512

f45dc7d41b9ef3770c813a99b05ca60ecb2c43be2ea0591b52a88c8ebb689126da7d49804d3ea1f03ffb79caf97ed140c2324a5609d6fc85a3ea6ec6d90460ee

Score

1^/10

Malware Config

Signatures

Modifies registry class 29 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\0\win64\ = "C:\\Windows\\SysWow64\\MbaeApi.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}\Programmable\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\0\win32\ = "C:\\Windows\\SysWOW64\\MbaeApi.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}\Version\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}\LocalServer32\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}\TypeLib\ = "{DD2C6F09-3156-1519-21DE-CE46E23F39A8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\0\win32\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}\TypeLib\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\0\win64\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}\ = "Jaqeto object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\0\win64	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}\LocalServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\ = "Definition: Internal API for MBAE Type Library."	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\0\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DD2C6F09-3156-1519-21DE-CE46E23F39A8}\1.0\FLAGS\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}\LocalServer32\ = "C:\\Windows\\helppane.exe"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7817763A-BE09-40E5-3C91-1E493665305A}\Programmable	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2636 wrote to memory of 4156	2636	regsvr32.exe	regsvr32.exe
PID 2636 wrote to memory of 4156	2636	regsvr32.exe	regsvr32.exe
PID 2636 wrote to memory of 4156	2636	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3b5b2300339fd2ff82f0dc567115d595a858bf0c17108629d9770e6d010b0ee3.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2636

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3b5b2300339fd2ff82f0dc567115d595a858bf0c17108629d9770e6d010b0ee3.dll
2⤵
- Modifies registry class
PID:4156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4156-130-0x0000000000000000-mapping.dmp

Download
memory/4156-131-0x0000000011000000-0x00000000111A8000-memory.dmp

Filesize
1.7MB

Download
memory/4156-132-0x0000000002D60000-0x0000000002DB4000-memory.dmp

Filesize
336KB

Download
memory/4156-133-0x0000000004680000-0x0000000004695000-memory.dmp

Filesize
84KB

Download
memory/4156-134-0x0000000002D60000-0x0000000002DB4000-memory.dmp

Filesize
336KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads