833c271783a98e034b8453c91a3f19587dc1a82eec84b977136a9faa6c4d22b4

Analysis

max time kernel
126s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.b24a0b0afa49541cd6bb5adc31673e40.dll
Size

304KB
MD5

b24a0b0afa49541cd6bb5adc31673e40
SHA1

4774e59beffc83dadc9164ac3552f27ee70044be
SHA256

833c271783a98e034b8453c91a3f19587dc1a82eec84b977136a9faa6c4d22b4
SHA512

99b4257a2546ef93bd6d218bc76d02bb757415d7dad90f102c636cf36ed9b189fcc2b9b0e772d4b0d3e90eeb486307527d6c09ac47118c2b3f8fae9f5e3b0b5a
SSDEEP

6144:jPlgbnLlSAya65Tp6lqIXcqaWKrqqDLuLM:jPynBt6t92qnu

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\TypeLib\ = "{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\TypeLib\ = "{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\ProgID\ = "DOGRUSVR.DogRuSvrCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\ = "DogRuSvr ActiveX Control module"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\ = "_DDogRuSvrEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\TypeLib\ = "{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\ = "_DDogRuSvr"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92FA68A0-4446-472C-BDA4-DD1394088DF0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DOGRUSVR.DogRuSvrCtrl.1\ = "DogRuSvr Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.b24a0b0afa49541cd6bb5adc31673e40.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\ = "_DDogRuSvrEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92FA68A0-4446-472C-BDA4-DD1394088DF0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEASB2~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DOGRUSVR.DogRuSvrCtrl.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DOGRUSVR.DogRuSvrCtrl.1\CLSID\ = "{48ED9E79-3B64-463C-84FA-18FFDCE026AB}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92FA68A0-4446-472C-BDA4-DD1394088DF0}\ = "DogRuSvr Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{92FA68A0-4446-472C-BDA4-DD1394088DF0}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEASB2~1.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\ = "DogRuSvr Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DOGRUSVR.DogRuSvrCtrl.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\MiscStatus\1\ = "131217"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\ = "_DDogRuSvr"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEASB2~1.DLL, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48ED9E79-3B64-463C-84FA-18FFDCE026AB}\TypeLib\ = "{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}\1.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B7B350C-F652-4E96-B2F6-9426E1AD0888}\TypeLib\ = "{208D9D7A-1A8F-455B-8EBC-2701EAAC2F65}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DA2C615D-9495-4650-B5CD-6AC98FD4403D}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 5004	936	regsvr32.exe	82
PID 936 wrote to memory of 5004	936	regsvr32.exe	82
PID 936 wrote to memory of 5004	936	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\NEAS.b24a0b0afa49541cd6bb5adc31673e40.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\NEAS.b24a0b0afa49541cd6bb5adc31673e40.dll
  2⤵
  - Modifies registry class
  PID:5004

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads