e7e50678a688b5a7bd3b76ca1e948809590ebff535881f9d245dafbfb8b3dc11

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08/01/2024, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RealMediaSplitter.dll
Size

360KB
MD5

aeea88436f977d470735763e8219dcee
SHA1

da0046e643f05bba45f2ba4b7a972570a00fd9dc
SHA256

be3c4fa646686fef1af3f15c930a496a0e1c2146232d9abe4e139922ca4ce624
SHA512

68b62e7370f9859497f1c9c3f13ae86f5c45d699771d5c3b65d32af3c009689b373df96aaa6e5bc2ebb56fa3aac1445ccc9d94a2ad6410e6be152ed76eb089c1
SSDEEP

6144:e78dRsJrLRqdRIS+ZUuq4YBLxzudLZCkegz5/AuVu0yoRaGe:N6JEduSwVybzuRZxegd4Wuf

Score

1^/10

Malware Config

Signatures

Modifies registry class 39 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}\0 = "0,4,,2E524D46"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\ = "NAGA RealMedia Source"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\ = "NAGA RealMedia Splitter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\ = "NAGA RealVideo Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7545090-002F-478A-9355-03577FA2B777}\ = "NAGA RealAudio Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\FriendlyName = "NAGA RealMedia Splitter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D7545090-002F-478A-9355-03577FA2B777}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}\Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7545090-002F-478A-9355-03577FA2B777}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7545090-002F-478A-9355-03577FA2B777}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RealMediaSplitter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D7545090-002F-478A-9355-03577FA2B777}\FriendlyName = "NAGA RealAudio Decoder"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D7545090-002F-478A-9355-03577FA2B777}\FilterData = 020000000000400002000000000000003070693300000000000000000900000000000000000000003074793300000000e0000000f00000003174793300000000e0000000000100003274793300000000e0000000100100003374793300000000e0000000200100003474793300000000e0000000300100003574793300000000e0000000400100003674793300000000e0000000500100003774793300000000e0000000600100003874793300000000e0000000700100003170693308000000000000000100000000000000000000003074793300000000e0000000800100006175647300001000800000aa00389b7131345f3400001000800000aa00389b7132385f3800001000800000aa00389b714154524300001000800000aa00389b71434f4f4b00001000800000aa00389b71444e455400001000800000aa00389b715349505200001000800000aa00389b71ff00000000001000800000aa00389b715241414300001000800000aa00389b715241435000001000800000aa00389b710100000000001000800000aa00389b71	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7545090-002F-478A-9355-03577FA2B777}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\CLSID = "{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\FriendlyName = "NAGA RealVideo Decoder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RealMediaSplitter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\FilterData = 02000000000040000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RealMediaSplitter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7545090-002F-478A-9355-03577FA2B777}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}\FilterData = 02000000000040000200000000000000307069330000000000000000040000000000000000000000307479330000000090000000a0000000317479330000000090000000b0000000327479330000000090000000c0000000337479330000000090000000d0000000317069330800000000000000010000000000000000000000307479330000000090000000e00000007669647300001000800000aa00389b715256323000001000800000aa00389b715256333000001000800000aa00389b715256343000001000800000aa00389b715256343100001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RealMediaSplitter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\FilterData = 020000000000400002000000000000003070693300000000000000000100000000000000000000003074793300000000500000006000000031706933080000000000000000000000000000000000000083eb36e44f52ce119f530020af0ba77000000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\FriendlyName = "NAGA RealMedia Source"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D7545090-002F-478A-9355-03577FA2B777}\CLSID = "{D7545090-002F-478A-9355-03577FA2B777}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{92DC875A-8746-4BC2-8EC7-4BA0443BBCD0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}\CLSID = "{D08A11FC-ABE2-4042-94A0-A9556E7C08AC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}\CLSID = "{E66FE32A-D298-4B89-8EF5-A5D2CE0105AF}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2968	1988	regsvr32.exe	28
PID 1988 wrote to memory of 2968	1988	regsvr32.exe	28
PID 1988 wrote to memory of 2968	1988	regsvr32.exe	28
PID 1988 wrote to memory of 2968	1988	regsvr32.exe	28
PID 1988 wrote to memory of 2968	1988	regsvr32.exe	28
PID 1988 wrote to memory of 2968	1988	regsvr32.exe	28
PID 1988 wrote to memory of 2968	1988	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\RealMediaSplitter.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\RealMediaSplitter.dll
  2⤵
  - Modifies registry class
  PID:2968

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads