833c271783a98e034b8453c91a3f19587dc1a82eec84b977136a9faa6c4d22b4

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.b24a0b0afa49541cd6bb5adc31673e40.dll
Size

304KB
MD5

b24a0b0afa49541cd6bb5adc31673e40
SHA1

4774e59beffc83dadc9164ac3552f27ee70044be
SHA256

833c271783a98e034b8453c91a3f19587dc1a82eec84b977136a9faa6c4d22b4
SHA512

99b4257a2546ef93bd6d218bc76d02bb757415d7dad90f102c636cf36ed9b189fcc2b9b0e772d4b0d3e90eeb486307527d6c09ac47118c2b3f8fae9f5e3b0b5a
SSDEEP

6144:jPlgbnLlSAya65Tp6lqIXcqaWKrqqDLuLM:jPynBt6t92qnu

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\ = "_DDogRuSvr"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\MiscStatus\1\ = "131217"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\TypeLib\ = "{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\ = "DogRuSvr ActiveX Control module"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.b24a0b0afa49541cd6bb5adc31673e40.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92FA68A0-4446-472C-BDA4-DD1394088DF0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEASB2~1.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\TypeLib\ = "{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92FA68A0-4446-472C-BDA4-DD1394088DF0}\ = "DogRuSvr Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92FA68A0-4446-472C-BDA4-DD1394088DF0}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEASB2~1.DLL, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\ = "DogRuSvr Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92FA68A0-4446-472C-BDA4-DD1394088DF0}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DOGRUSVR.DogRuSvrCtrl.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEASB2~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\TypeLib\ = "{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\ProgID\ = "DOGRUSVR.DogRuSvrCtrl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\ = "_DDogRuSvr"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\ = "_DDogRuSvrEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\ = "_DDogRuSvrEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\TypeLib\ = "{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DOGRUSVR.DogRuSvrCtrl.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DOGRUSVR.DogRuSvrCtrl.1\ = "DogRuSvr Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DOGRUSVR.DogRuSvrCtrl.1\CLSID\ = "{48ED9E79-3B64-463C-84FA-18FFDCE026AB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\ProxyStubClsid32	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3040	2916	regsvr32.exe	27
PID 2916 wrote to memory of 3040	2916	regsvr32.exe	27
PID 2916 wrote to memory of 3040	2916	regsvr32.exe	27
PID 2916 wrote to memory of 3040	2916	regsvr32.exe	27
PID 2916 wrote to memory of 3040	2916	regsvr32.exe	27
PID 2916 wrote to memory of 3040	2916	regsvr32.exe	27
PID 2916 wrote to memory of 3040	2916	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.b24a0b0afa49541cd6bb5adc31673e40.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.b24a0b0afa49541cd6bb5adc31673e40.dll
  2⤵
  - Modifies registry class
  PID:3040

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads