f0595b6040ec289b66c7d9cf1303d6a9de37956cf3ed3b4ae0e38f7398d7afef

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DBLIST32.dll
Size

195KB
MD5

fae53fad924a437af259649419c806e2
SHA1

ae504aee64256cafa9e704f0be9fc310d31deb75
SHA256

114c72a291f7ac60d74d9f51d5b586915c768a7c19e5412476d0f0db994dd225
SHA512

0259e734c107ae3e58cb39f836539ff31e878db5e2ad66345da862adb8a9ce43ae3fb499f6301b2615e3d6c4af43896a969a7d54adf6e4af815b02b1288399b5
SSDEEP

6144:5TUF/tp4hc66qvBaHLldRqVAPX8lHAYN0:5egh8qJaJdRqVfOY0

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBCombo.1\CLSID\ = "{FAEEE760-117E-101B-8933-08002B2F4F5A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAEEE763-117E-101B-8933-08002B2F4F5A}\1.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02A69B02-081B-101B-8933-08002B2F4F5A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBList.1\ = "Microsoft DBList Control, version 6.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0E0AA20-3082-11CF-AEBE-00AA00A8F7F3}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09194000-DF6E-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09194002-DF6E-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBList.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09194000-DF6E-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02A69B02-081B-101B-8933-08002B2F4F5A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FAEEE762-117E-101B-8933-08002B2F4F5A}\TypeLib\Version = "1.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09194000-DF6E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObjectFiles"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAEEE763-117E-101B-8933-08002B2F4F5A}\1.1\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ = "IVBDataObjectFiles"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{09194000-DF6E-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09194000-DF6E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBList	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\VersionIndependentProgID\ = "MSDBCtls.DBList"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FAEEE762-117E-101B-8933-08002B2F4F5A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{02A69B02-081B-101B-8933-08002B2F4F5A}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\Required Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0E0AA20-3082-11CF-AEBE-00AA00A8F7F3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DBLIST32.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib\Version = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\ = "Microsoft DBList Control, version 6.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAEEE763-117E-101B-8933-08002B2F4F5A}\1.1\ = "Microsoft Data Bound List Controls 6.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\Required Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib\ = "{FAEEE763-117E-101B-8933-08002B2F4F5A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02A69B02-081B-101B-8933-08002B2F4F5A}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAEEE763-117E-101B-8933-08002B2F4F5A}\1.1\HELPDIR\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{09194002-DF6E-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{FAEEE763-117E-101B-8933-08002B2F4F5A}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\TypeLib\ = "{FAEEE763-117E-101B-8933-08002B2F4F5A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DBLIST32.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FAEEE762-117E-101B-8933-08002B2F4F5A}\TypeLib\ = "{FAEEE763-117E-101B-8933-08002B2F4F5A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAEEE763-117E-101B-8933-08002B2F4F5A}\1.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DBLIST32.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FAEEE762-117E-101B-8933-08002B2F4F5A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\Version\ = "1.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DBLIST32.dll, 2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9F6AA700-D188-11CD-AD48-00AA003C9CB6}\ = "IRowCursor"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBList\CLSID\ = "{02A69B00-081B-101B-8933-08002B2F4F5A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02A69B00-081B-101B-8933-08002B2F4F5A}\ProgID\ = "MSDBCtls.DBList.1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDBCtls.DBList.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FAEEE760-117E-101B-8933-08002B2F4F5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DBLIST32.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 1832	4516	regsvr32.exe	90
PID 4516 wrote to memory of 1832	4516	regsvr32.exe	90
PID 4516 wrote to memory of 1832	4516	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\DBLIST32.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\DBLIST32.dll
  2⤵
  - Modifies registry class
  PID:1832

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads