ae6ef57fe5fb45c2b7fd541240e90dc8957786c18f1394d68fe7eb6736db24ba

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plug/EyLogin.dll
Size

660KB
MD5

564903d760cacb39ef14df0419f03d18
SHA1

1bca18834c6b9405944747c0e4a47d4680fa4f40
SHA256

1e8134a9b97b08ab8200450c75a2aeb0f316dc93b95a4a389dfb7b9233cb3b32
SHA512

449edfecccd8da026bb072890cdf5ca9587e8e1011a653ec105f8716d4e08c6a0e9da34101544673b0c95b29eb2b6ad5630b684baca67d5d843a2d2eee2c5d77
SSDEEP

12288:1+L8oRCosSxyqnONoC0nc7JHuKLgMZLGzeFp+1h9CoC+2uN0E:PoRCfU3ONp0c7JHVFLZFp+1zNyU

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2584	regsvr32.exe

Modifies registry class 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\plug"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EyLogin.EyLoginSoft.1\ = "EyLoginSoft Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EyLogin.EyLoginSoft\CLSID\ = "{0B452213-2BE5-4F5F-A352-149513851BC7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EyLogin.EyLoginSoft\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B452213-2BE5-4F5F-A352-149513851BC7}\ = "EyLoginSoft Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B452213-2BE5-4F5F-A352-149513851BC7}\VersionIndependentProgID\ = "EyLogin.EyLoginSoft"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\plug\\EyLogin.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EyLogin.EyLoginSoft.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EyLogin.EyLoginSoft.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B452213-2BE5-4F5F-A352-149513851BC7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B452213-2BE5-4F5F-A352-149513851BC7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B452213-2BE5-4F5F-A352-149513851BC7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\plug\\EyLogin.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}\TypeLib\ = "{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}\ = "IEyLoginSoft"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}\ = "IEyLoginSoft"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EyLogin.EyLoginSoft	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B452213-2BE5-4F5F-A352-149513851BC7}\ProgID\ = "EyLogin.EyLoginSoft.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B452213-2BE5-4F5F-A352-149513851BC7}\TypeLib\ = "{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}\1.0\ = "EyLogin 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EyLogin.EyLoginSoft\ = "EyLoginSoft Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EyLogin.EyLoginSoft\CurVer\ = "EyLogin.EyLoginSoft.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B452213-2BE5-4F5F-A352-149513851BC7}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B452213-2BE5-4F5F-A352-149513851BC7}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B452213-2BE5-4F5F-A352-149513851BC7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EyLogin.EyLoginSoft.1\CLSID\ = "{0B452213-2BE5-4F5F-A352-149513851BC7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B452213-2BE5-4F5F-A352-149513851BC7}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0B452213-2BE5-4F5F-A352-149513851BC7}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EyLogin.EyLoginSoft\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5E9C69D2-B6E7-40B9-B775-CBDBF4A07A67}\TypeLib\ = "{AAD400B9-BF75-4E56-B06A-CCC47BDB4745}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2584	2728	regsvr32.exe	28
PID 2728 wrote to memory of 2584	2728	regsvr32.exe	28
PID 2728 wrote to memory of 2584	2728	regsvr32.exe	28
PID 2728 wrote to memory of 2584	2728	regsvr32.exe	28
PID 2728 wrote to memory of 2584	2728	regsvr32.exe	28
PID 2728 wrote to memory of 2584	2728	regsvr32.exe	28
PID 2728 wrote to memory of 2584	2728	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\plug\EyLogin.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\plug\EyLogin.dll
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies registry class
  PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2584-0-0x0000000010000000-0x000000001017A000-memory.dmp

Filesize
1.5MB

Download
memory/2584-1-0x0000000010000000-0x000000001017A000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads