6a7dceb274f1c9dce10192414d3826b51ce9d9f84ff6f3e1adc78baa9a8f8d0c

Analysis

max time kernel
130s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SDClient.dll
Size

200KB
MD5

93627d06d7a53d1032c0f9bcdf2c8fe9
SHA1

9a57ab2ab6b7f128048d2876250a9df5328cb67a
SHA256

6a7dceb274f1c9dce10192414d3826b51ce9d9f84ff6f3e1adc78baa9a8f8d0c
SHA512

8a69d89384608640a09b97340b7b110b3769ed824fc009af4dfec9dbf67272a4e62432e32a5bd44d98dc8de24b1f3d1257aec3084bb121639b3274e88205d750
SSDEEP

3072:6zDqROl9JLeYjOe9KQpKGz0Nt3s0vzjLL4jFTgITQSmY15A7D:6vqROl9JLeYSe1N0Hs0PLEgITQxSi

Score

1^/10

Malware Config

Signatures

Modifies registry class 57 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDConnHdl	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDConnHdl\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SDClient.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}\TypeLib\ = "{12341570-f93b-4abd-8a6d-4ecf01209939}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{12341570-F93B-4ABD-8A6D-4ECF01209939}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDConnHdl.1\ = "SDConnHdl Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDConnHdl.1\CLSID\ = "{1fefd825-016b-484c-a0aa-616c5f371c1f}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\TypeLib\ = "{12341570-f93b-4abd-8a6d-4ecf01209939}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}\ProgID\ = "TSSDClient.SessionArbitrationHelper.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDConnHdl\CurVer\ = "TSSDClient.SDConnHdl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SDClient.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SessionArbitrationHelper.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}\VersionIndependentProgID\ = "TSSDClient.SDSessionArbitrationHelper"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{12341570-F93B-4ABD-8A6D-4ECF01209939}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\ = "SDConnHdl Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SessionArbitrationHelper.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDSessionArbitrationHelper\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}\InprocServer32\ThreadingModel = "Free"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\ProgID\ = "TSSDClient.SDConnHdl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SessionArbitrationHelper.1\ = "SDSessionArbitrationHelper Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDSessionArbitrationHelper\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{12341570-F93B-4ABD-8A6D-4ECF01209939}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDConnHdl\ = "SDConnHdl Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\VersionIndependentProgID\ = "TSSDClient.SDConnHdl"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDSessionArbitrationHelper\CurVer\ = "TSSDClient.SDSessionArbitrationHelper.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}\ = "SDSessionArbitrationHelper Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDConnHdl\CLSID\ = "{1fefd825-016b-484c-a0aa-616c5f371c1f}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{12341570-F93B-4ABD-8A6D-4ECF01209939}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SDClient.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDConnHdl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDSessionArbitrationHelper	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{12341570-F93B-4ABD-8A6D-4ECF01209939}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{12341570-F93B-4ABD-8A6D-4ECF01209939}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDSessionArbitrationHelper\CLSID\ = "{c9fcb054-949a-4088-ba5b-8ee5caec5c69}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDConnHdl\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SessionArbitrationHelper.1\CLSID\ = "{c9fcb054-949a-4088-ba5b-8ee5caec5c69}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{12341570-F93B-4ABD-8A6D-4ECF01209939}\1.0\ = "SDClient Connection Handler 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{12341570-F93B-4ABD-8A6D-4ECF01209939}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{12341570-F93B-4ABD-8A6D-4ECF01209939}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDConnHdl.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1fefd825-016b-484c-a0aa-616c5f371c1f}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c9fcb054-949a-4088-ba5b-8ee5caec5c69}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TSSDClient.SDSessionArbitrationHelper\ = "SDSessionArbitrationHelper Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{12341570-F93B-4ABD-8A6D-4ECF01209939}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 1876	3060	regsvr32.exe	82
PID 3060 wrote to memory of 1876	3060	regsvr32.exe	82
PID 3060 wrote to memory of 1876	3060	regsvr32.exe	82

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\SDClient.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\SDClient.dll
  2⤵
  - Modifies registry class
  PID:1876

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads