8bbb55ab3cd37734c13c32ce6096fc353f997a850a4d175d1f7e3ad3c81c7b30

Analysis

max time kernel
134s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KuGoo3DownXControl.dll
Size

542KB
MD5

b358c3102f8434670ba573950210167e
SHA1

f147fa98e182eceaa337c746e7032595b0b78f87
SHA256

a6ae76fe7bb10aa7893de011990a859620baa74a6f87d5e78d6005e69e7e448b
SHA512

d4d33d1034707ca8a5469c85f787a30ad236881101119340a4f809da4d7f37a3fbd8c74252c94479a149a9a08a01b39d0ca1f3745721875950ad72b8411c6982
SSDEEP

12288:9fuE7mPgu3cYIsgiP7zO2f7kUJZ8jTLxfUe3T:MoC3tFgm7zO2fxJZ8jTNfVj

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\Verb\0\ = "Properties,0,2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KuGoo3DownXControl.KuGoo3Down\ = "KuGoo3Down Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\TypeLib\ = "{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KuGoo3DownXControl.dll,1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\TypeLib\ = "{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC4FBC7-AA38-45EC-9634-D6D20B679EFC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KuGoo3DownXControl.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\ProgID\ = "KuGoo3DownXControl.KuGoo3Down"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\Control\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}\1.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C8C35BC-8E8E-46BC-A4CC-F26D9F804763}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC4FBC7-AA38-45EC-9634-D6D20B679EFC}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\Verb\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\ = "IKuGoo3Down"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C8C35BC-8E8E-46BC-A4CC-F26D9F804763}\ = "IKuGoo3DownEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C8C35BC-8E8E-46BC-A4CC-F26D9F804763}\TypeLib\ = "{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\KuGoo3	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\Verb	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\MiscStatus\1\ = "205201"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C8C35BC-8E8E-46BC-A4CC-F26D9F804763}\TypeLib\ = "{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC4FBC7-AA38-45EC-9634-D6D20B679EFC}\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\KuGoo3\CLSID = "{6AC4FBC7-AA38-45EC-9634-D6D20B679EFC}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KuGoo3DownXControl.KuGoo3Down\Clsid\ = "{162AF25B-5A2A-448E-A842-194653EF3E05}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\KuGoo\CLSID = "{6AC4FBC7-AA38-45EC-9634-D6D20B679EFC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KuGoo3DownXControl.KuGoo3Down	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KuGoo3DownXControl.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C8C35BC-8E8E-46BC-A4CC-F26D9F804763}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KuGoo3DownXControl.KuGoo3Proto\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C8C35BC-8E8E-46BC-A4CC-F26D9F804763}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\ = "KuGoo3Down Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}\1.0\ = "KuGoo3DownXControl Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C8C35BC-8E8E-46BC-A4CC-F26D9F804763}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C8C35BC-8E8E-46BC-A4CC-F26D9F804763}\ = "IKuGoo3DownEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC4FBC7-AA38-45EC-9634-D6D20B679EFC}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KuGoo3DownXControl.KuGoo3Proto\Clsid\ = "{6AC4FBC7-AA38-45EC-9634-D6D20B679EFC}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C8C35BC-8E8E-46BC-A4CC-F26D9F804763}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KuGoo3DownXControl.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{162AF25B-5A2A-448E-A842-194653EF3E05}\Verb\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\TypeLib\ = "{04B9A4F6-B3C8-4227-BEB7-11DB11D15647}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE269465-D334-414A-BB1F-2F53FAD77251}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KuGoo3DownXControl.KuGoo3Proto\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KuGoo3DownXControl.KuGoo3Proto	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 4896	3632	regsvr32.exe	83
PID 3632 wrote to memory of 4896	3632	regsvr32.exe	83
PID 3632 wrote to memory of 4896	3632	regsvr32.exe	83

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\KuGoo3DownXControl.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\KuGoo3DownXControl.dll
  2⤵
  - Modifies registry class
  PID:4896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4896-0-0x0000000000D00000-0x0000000000D8E000-memory.dmp

Filesize
568KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads