6b9224d24df4bb7983107530890a0d163be155c177f730111c1be820e2e42ae0

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Codecs/RealMediaSplitter.dll
Size

372KB
MD5

b91968f4f21d803d2467da89d9cd7275
SHA1

a0e1a676fe340f6bd211a1b40c0b6d8d1715d82e
SHA256

4287023170ab52ec3883af9a464d281358ae44225b25b101697c2ae66c82f935
SHA512

047470fda7ff9cda15cc4baaf0d5031bc8c37a9a7a827601c0e6db149f3af5149860afc45dd92c1a035f537971a70cb0f31372de12c080cecc3d93a89e6b8d65
SSDEEP

6144:sbH9JP/W0D2hzNqURg44nlHR0urOU48+EQHapawA9MDL:OJP/W0D2Pq/rpR0urOU4lExnn

Score

1^/10

Malware Config

Signatures

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Codecs\\RealMediaSplitter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}\Source Filter = "{E436EBB5-524F-11CE-9F53-0020AF0BA770}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Codecs\\RealMediaSplitter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\ = "RealAudio Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\FriendlyName = "RealMedia Splitter"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}\FilterData = 02000000000060000000000000000000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\FriendlyName = "RealVideo Decoder"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}\FriendlyName = "RealAudio Decoder"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}\FilterData = 020000000000600002000000000000003070693300000000000000000900000000000000000000003074793300000000e0000000f00000003174793300000000e0000000000100003274793300000000e0000000100100003374793300000000e0000000200100003474793300000000e0000000300100003574793300000000e0000000400100003674793300000000e0000000500100003774793300000000e0000000600100003874793300000000e0000000700100003170693308000000000000000100000000000000000000003074793300000000e0000000800100006175647300001000800000aa00389b7131345f3400001000800000aa00389b7132385f3800001000800000aa00389b714154524300001000800000aa00389b71434f4f4b00001000800000aa00389b71444e455400001000800000aa00389b715349505200001000800000aa00389b71ff00000000001000800000aa00389b715241414300001000800000aa00389b715241435000001000800000aa00389b710100000000001000800000aa00389b71	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Media Type\{E436EB83-524F-11CE-9F53-0020AF0BA770}\{57428EC6-C2B2-44A2-AA9C-28F0B6A5C48E}\0 = "0,4,,2E524D46"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\FilterData = 02000000000060000200000000000000307069330000000000000000040000000000000000000000307479330000000090000000a0000000317479330000000090000000b0000000327479330000000090000000c0000000337479330000000090000000d0000000317069330800000000000000010000000000000000000000307479330000000090000000e00000007669647300001000800000aa00389b715256323000001000800000aa00389b715256333000001000800000aa00389b715256343000001000800000aa00389b715256343100001000800000aa00389b7100000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Codecs\\RealMediaSplitter.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Codecs\\RealMediaSplitter.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\CLSID = "{E21BE468-5C18-43EB-B0CC-DB93A847D769}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\FilterData = 020000000000600002000000000000003070693300000000000000000100000000000000000000003074793300000000500000006000000031706933080000000000000000000000000000000000000083eb36e44f52ce119f530020af0ba77000000000000000000000000000000000	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\CLSID = "{238D0F23-5DC9-45A6-9BE2-666160C324DD}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{941A4793-A705-4312-8DFC-C11CA05F397E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E21BE468-5C18-43EB-B0CC-DB93A847D769}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E21BE468-5C18-43EB-B0CC-DB93A847D769}\ = "RealMedia Splitter"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{238D0F23-5DC9-45A6-9BE2-666160C324DD}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{765035B3-5944-4A94-806B-20EE3415F26F}\ = "RealMedia Source"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{238D0F23-5DC9-45A6-9BE2-666160C324DD}\ = "RealVideo Decoder"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}\FriendlyName = "RealMedia Source"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{765035B3-5944-4A94-806B-20EE3415F26F}\CLSID = "{765035B3-5944-4A94-806B-20EE3415F26F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{941A4793-A705-4312-8DFC-C11CA05F397E}\CLSID = "{941A4793-A705-4312-8DFC-C11CA05F397E}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2980	2188	regsvr32.exe	28
PID 2188 wrote to memory of 2980	2188	regsvr32.exe	28
PID 2188 wrote to memory of 2980	2188	regsvr32.exe	28
PID 2188 wrote to memory of 2980	2188	regsvr32.exe	28
PID 2188 wrote to memory of 2980	2188	regsvr32.exe	28
PID 2188 wrote to memory of 2980	2188	regsvr32.exe	28
PID 2188 wrote to memory of 2980	2188	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Codecs\RealMediaSplitter.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\Codecs\RealMediaSplitter.dll
  2⤵
  - Modifies registry class
  PID:2980

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads