Overview
overview
7Static
static
7bf64c967af...d9b.7z
windows7-x64
3bf64c967af...d9b.7z
windows10-2004-x64
7mplayer/av...52.dll
windows7-x64
3mplayer/av...52.dll
windows10-2004-x64
3mplayer/avcore-0.dll
windows7-x64
1mplayer/avcore-0.dll
windows10-2004-x64
1mplayer/av...52.dll
windows7-x64
3mplayer/av...52.dll
windows10-2004-x64
3mplayer/avutil-50.dll
windows7-x64
1mplayer/avutil-50.dll
windows10-2004-x64
1mplayer/co...er.dll
windows7-x64
1mplayer/co...er.dll
windows10-2004-x64
1mplayer/co...er.dll
windows7-x64
1mplayer/co...er.dll
windows10-2004-x64
1mplayer/co...rc.dll
windows7-x64
3mplayer/co...rc.dll
windows10-2004-x64
3mplayer/co...ok.dll
windows7-x64
3mplayer/co...ok.dll
windows10-2004-x64
mplayer/co...vc.dll
windows7-x64
3mplayer/co...vc.dll
windows10-2004-x64
3mplayer/co...71.dll
windows7-x64
3mplayer/co...71.dll
windows10-2004-x64
3mplayer/co...er.htm
windows7-x64
1mplayer/co...er.htm
windows10-2004-x64
1mplayer/co...er.dll
windows7-x64
1mplayer/co...er.dll
windows10-2004-x64
1mplayer/co...rt.dll
windows7-x64
3mplayer/co...rt.dll
windows10-2004-x64
3mplayer/co...ac.dll
windows7-x64
3mplayer/co...ac.dll
windows10-2004-x64
3mplayer/co...pr.dll
windows7-x64
1mplayer/co...pr.dll
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 00:42
Behavioral task
behavioral1
Sample
bf64c967afff4448d91021f5f215bd9b.7z
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
bf64c967afff4448d91021f5f215bd9b.7z
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
mplayer/avcodec-52.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
mplayer/avcodec-52.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
mplayer/avcore-0.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
mplayer/avcore-0.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
mplayer/avformat-52.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
mplayer/avformat-52.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
mplayer/avutil-50.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral10
Sample
mplayer/avutil-50.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
mplayer/codecs/MatroskaSplitter.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral12
Sample
mplayer/codecs/MatroskaSplitter.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
mplayer/codecs/RealMediaSplitter.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
mplayer/codecs/RealMediaSplitter.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
mplayer/codecs/atrc.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
mplayer/codecs/atrc.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
mplayer/codecs/cook.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral18
Sample
mplayer/codecs/cook.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
mplayer/codecs/drvc.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
mplayer/codecs/drvc.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
mplayer/codecs/msvcr71.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
mplayer/codecs/msvcr71.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
mplayer/codecs/plugins/Enhancer/enhancer.htm
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
mplayer/codecs/plugins/Enhancer/enhancer.htm
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
mplayer/codecs/plugins/dsp_enhancer.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
mplayer/codecs/plugins/dsp_enhancer.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
mplayer/codecs/pncrt.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral28
Sample
mplayer/codecs/pncrt.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
mplayer/codecs/raac.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
mplayer/codecs/raac.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
mplayer/codecs/sipr.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral32
Sample
mplayer/codecs/sipr.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
mplayer/codecs/RealMediaSplitter.dll
-
Size
429KB
-
MD5
7546d04d91a073aa51900aaa9a7e04d0
-
SHA1
7bf394549b4fc9496ba35d1b555d7937d7ac095c
-
SHA256
c32360f26101a32e3bbc7f67a3aafd8f6a794940aa63fd662d8a92cfc59ac1f1
-
SHA512
4edeac863ac100adf995e3f4afb553b2e5ba273b72461ca82779c3ebfc1583752bfed4fe630564a1d6c9222a02adc2584795c373c84d3230a04fc1db65fabb0c
-
SSDEEP
12288:UGPjPHHMsM72GXWCD3JuMUVieppI4BWBI:Zj/HMsM7NWVieppI4BWBI
Malware Config
Signatures
-
Modifies registry class 39 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mplayer\\codecs\\RealMediaSplitter.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\ = "MPC - RealAudio Decoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}\0 = "0,4,,2E524D46" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\ = "MPC - RealMedia Source" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\CLSID = "{E21BE468-5C18-43EB-B0CC-DB93A847D769}" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\FilterData = 020000000000600002000000000000003070693300000000000000000100000000000000000000003074793300000000500000006000000031706933080000000000000000000000000000000000000083eb36e44f52ce119f530020af0ba77000000000000000000000000000000000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mplayer\\codecs\\RealMediaSplitter.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}\FriendlyName = "MPC - RealMedia Source" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\FriendlyName = "MPC - RealVideo Decoder" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\FilterData = 02000000000060000200000000000000307069330000000000000000040000000000000000000000307479330000000090000000a0000000317479330000000090000000b0000000327479330000000090000000c0000000337479330000000090000000d0000000317069330800000000000000010000000000000000000000307479330000000090000000e00000007669647300001000800000aa00389b715256323000001000800000aa00389b715256333000001000800000aa00389b715256343000001000800000aa00389b715256343100001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}\CLSID = "{941A4793-A705-4312-8DFC-C11CA05F397E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\FriendlyName = "MPC - RealMedia Splitter" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}\FriendlyName = "MPC - RealAudio Decoder" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}\FilterData = 020000000000600002000000000000003070693300000000000000000900000000000000000000003074793300000000e0000000f00000003174793300000000e0000000000100003274793300000000e0000000100100003374793300000000e0000000200100003474793300000000e0000000300100003574793300000000e0000000400100003674793300000000e0000000500100003774793300000000e0000000600100003874793300000000e0000000700100003170693308000000000000000100000000000000000000003074793300000000e0000000800100006175647300001000800000aa00389b7131345f3400001000800000aa00389b7132385f3800001000800000aa00389b714154524300001000800000aa00389b71434f4f4b00001000800000aa00389b71444e455400001000800000aa00389b715349505200001000800000aa00389b71ff00000000001000800000aa00389b715241414300001000800000aa00389b715241435000001000800000aa00389b710100000000001000800000aa00389b71 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}\Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\ = "MPC - RealMedia Splitter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mplayer\\codecs\\RealMediaSplitter.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD} regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}\FilterData = 02000000000060000000000000000000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\CLSID = "{238D0F23-5DC9-45A6-9BE2-666160C324DD}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}\CLSID = "{765035B3-5944-4A94-806B-20EE3415F26F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\ = "MPC - RealVideo Decoder" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mplayer\\codecs\\RealMediaSplitter.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{238D0F23-5DC9-45A6-9BE2-666160C324DD} regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2440 2132 regsvr32.exe 28 PID 2132 wrote to memory of 2440 2132 regsvr32.exe 28 PID 2132 wrote to memory of 2440 2132 regsvr32.exe 28 PID 2132 wrote to memory of 2440 2132 regsvr32.exe 28 PID 2132 wrote to memory of 2440 2132 regsvr32.exe 28 PID 2132 wrote to memory of 2440 2132 regsvr32.exe 28 PID 2132 wrote to memory of 2440 2132 regsvr32.exe 28
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\mplayer\codecs\RealMediaSplitter.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\mplayer\codecs\RealMediaSplitter.dll2⤵
- Modifies registry class
PID:2440
-