55453f794fbc569bf4afdf593aa27ff863bf1e1c67c7ccb5eb7bf48f29ff0de4

Analysis

max time kernel
514s
max time network
516s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
30/05/2024, 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$SYSDIR/CryptoKit.HSBC.x86.dll
Size

1.0MB
MD5

d6093ec468e383c616154ec1c92e3f53
SHA1

9dd2406105c67f86085c9a82475c1e903690dc81
SHA256

fa69867c017873a36f500ff84dddde62439e3960dfae7d30b4038a4b56e834b2
SHA512

10ab0650d7e8e294cb6d4b7a7ff3e6e2ea4f1893be32eb00bd5db4bee0b2e6b51dab50e0f66500bf5602f1eec3abc236b3492cec97afa67470928d6260676e89
SSDEEP

24576:59imEEBDlFxRvhxB3srzAzj2ByAEmXsa+:59ijgfHBGzs2oAEosj

Score

1^/10

Malware Config

Signatures

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}\TypeLib\ = "{772C831A-5AB0-4E66-A03D-1174F8690D40}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}\TypeLib\ = "{772C831A-5AB0-4E66-A03D-1174F8690D40}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{772C831A-5AB0-4E66-A03D-1174F8690D40}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{772C831A-5AB0-4E66-A03D-1174F8690D40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.1\ = "CryptoAgent Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}\ = "ICryptoAgent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}\ProgID\ = "CryptoKit.CryptoAgent.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{772C831A-5AB0-4E66-A03D-1174F8690D40}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\CryptoKit.HSBC.x86.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}\VersionIndependentProgID\ = "CryptoKit.CryptoAgent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{772C831A-5AB0-4E66-A03D-1174F8690D40}\1.0\ = "CryptoKit.HSBC.x86 3.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.1\CLSID\ = "{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{772C831A-5AB0-4E66-A03D-1174F8690D40}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}\ = "ICryptoAgent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\$SYSDIR\\CryptoKit.HSBC.x86.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{772C831A-5AB0-4E66-A03D-1174F8690D40}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{772C831A-5AB0-4E66-A03D-1174F8690D40}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{772C831A-5AB0-4E66-A03D-1174F8690D40}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39946100-D817-497C-AF89-D72EF3C2479F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent\CurVer\ = "CryptoKit.CryptoAgent.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{772C831A-5AB0-4E66-A03D-1174F8690D40}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}\TypeLib\ = "{772C831A-5AB0-4E66-A03D-1174F8690D40}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{772C831A-5AB0-4E66-A03D-1174F8690D40}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent\ = "CryptoAgent Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CryptoKit.CryptoAgent\CLSID\ = "{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}\ = "CryptoAgent Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AEB90D6-B42F-4FA5-A126-493F2AA8F354}\ProgID	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4808	4144	regsvr32.exe	74
PID 4144 wrote to memory of 4808	4144	regsvr32.exe	74
PID 4144 wrote to memory of 4808	4144	regsvr32.exe	74

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\CryptoKit.HSBC.x86.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\$SYSDIR\CryptoKit.HSBC.x86.dll
  2⤵
  - Modifies registry class
  PID:4808

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads