e737c2180807ae910e9d228b5ded5106fac25d1c02e09ad3f67f913db21ce59a

Analysis

max time kernel
154s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6bb2d88a69af028f9aba80c897b9cf6c.dll
Size

368KB
MD5

6bb2d88a69af028f9aba80c897b9cf6c
SHA1

5472f1cdb228602951553f7d36cfb535e743c915
SHA256

e737c2180807ae910e9d228b5ded5106fac25d1c02e09ad3f67f913db21ce59a
SHA512

55c6e69b02a4cc16538dd5e83d65b833d51bbbf5221d1dc13ee0d7d01b8f4b5005ea0361037c88df15b2071fe8a277f23d879dc27924cd225cf44b48cba1d3fb
SSDEEP

6144:c2lkEurS0HhRvIR40PtPps+JPZQzhEsFFehrKDXSooK6rb4sh7xQCCwp6:xl0hhO4WtPNQNEsDXDXHQkqCc6

Score

1^/10

Malware Config

Signatures

Modifies registry class 53 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89FBF526-AB75-4D2D-AB79-C64221C7F354}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6bb2d88a69af028f9aba80c897b9cf6c.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientMetaSearch.ClientMetaSearch\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientMetaSearch.ClientMetaSearch\Clsid\ = "{89FBF526-AB75-4D2D-AB79-C64221C7F354}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89FBF526-AB75-4D2D-AB79-C64221C7F354}\ = "ClientMetaSearch Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89FBF526-AB75-4D2D-AB79-C64221C7F354}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89FBF526-AB75-4D2D-AB79-C64221C7F354}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}\ = "IClientMetaSearchEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}\ = "IClientMetaSearchEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89FBF526-AB75-4D2D-AB79-C64221C7F354}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89FBF526-AB75-4D2D-AB79-C64221C7F354}\ProgID\ = "ClientMetaSearch.ClientMetaSearch"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89FBF526-AB75-4D2D-AB79-C64221C7F354}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}\1.0\ = "Client Meta Search Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89FBF526-AB75-4D2D-AB79-C64221C7F354}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6bb2d88a69af028f9aba80c897b9cf6c.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89FBF526-AB75-4D2D-AB79-C64221C7F354}\TypeLib\ = "{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}\ = "IClientMetaSearch"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}\TypeLib\ = "{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}\TypeLib\ = "{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientMetaSearch.ClientMetaSearch	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89FBF526-AB75-4D2D-AB79-C64221C7F354}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}\TypeLib\ = "{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}\TypeLib\ = "{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89FBF526-AB75-4D2D-AB79-C64221C7F354}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientMetaSearch.ClientMetaSearch\ = "ClientMetaSearch Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8C3A5DF0-DE2F-4EA2-B5D8-078C79F5B942}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5B8501E4-75E0-429F-89E2-549CF97D1692}\ = "IClientMetaSearch"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{115E6C42-6F14-4F9F-9A03-EABEB5E8A082}\ProxyStubClsid32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 1928	3220	regsvr32.exe	90
PID 3220 wrote to memory of 1928	3220	regsvr32.exe	90
PID 3220 wrote to memory of 1928	3220	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6bb2d88a69af028f9aba80c897b9cf6c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6bb2d88a69af028f9aba80c897b9cf6c.dll
  2⤵
  - Modifies registry class
  PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1928-1-0x0000000000A90000-0x0000000000A92000-memory.dmp

Filesize
8KB

Download
memory/1928-2-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads