5ed97453be92c324567e6d0baf4bc7d001b5925e71ad957e495463893ed1af1d

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AlphaDIB.dll
Size

740KB
MD5

08f61aa236190c5ae82ac2025312fc67
SHA1

17561c1bc8526a14e19168ac2e72000874250e40
SHA256

45d06642016f4037ae707a1ed07546cdfa679ab96b9bb2c808b8c846334a7a88
SHA512

057ab52f42c2678cd4597cbd1df39e43809c00420a0086a11d812cf7e7e0f85feb75fe818cf7ce5f70a518589200caa4e2b27b41cb9c8de3ba418e468328c85f
SSDEEP

12288:Wgkq1G4jM9zwvWIIDeV5VGRDSZvWH5O67EMI/zXy/Xwu/sro3X5AzTtTnB:Wgv1DjMJwvWIIK5VwWZviO67EMI/zXy

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{22005FBF-3C18-4CBF-B473-3E27C1643E9A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{52A27DE3-C1F1-4E4E-A6AC-1051C48C4822}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E063117A-4B4B-481C-A22C-8B2FDB2D1A53}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9616C7E9-5CCD-4422-808A-2A5FDDD59FF6}\TypeLib\Version = "7.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2BAFF457-D4A7-4C68-B96B-AE0DD37E4BF6}\TypeLib\Version = "7.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B29CCE02-05D4-4A54-9EAD-67BD03E5C26D}\TypeLib\ = "{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FCB69DC-57E4-46DB-805F-E3E747F6D012}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E30E45DE-14C3-4C39-8BFF-D97A2F6BB60B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F589A524-BD2A-4796-8039-F3087AFDF19C}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{060F4642-855F-4380-92CC-05B2EF76CABB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cBitmap\ = "Bitmap Cache Class(Not Stable)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C7BD216-F558-41B3-B16A-34C832DB214C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{26981441-2430-426A-8977-F1D5591203EF}\TypeLib\ = "{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EB64583-9422-4C0B-BC3A-A3B00497112D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FBD0810B-66C1-4CDD-B04B-CFB636A3B8E7}\ = "cScrollBar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{18771EB5-446B-4FD1-9339-907D9B91C1E5}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cBitmap\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{077843BD-79F8-435B-8065-FA96B69499CD}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cCommonDialog\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.Class3\Clsid\ = "{18771EB5-446B-4FD1-9339-907D9B91C1E5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cDIBShadowCreator	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2673643C-7824-41E7-9A9F-D487C4DE4160}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{938AB9FB-2726-4636-B373-042EE0A0F861}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{26981441-2430-426A-8977-F1D5591203EF}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cInifile\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F7DF1A90-7546-41BE-B0F9-4F26A7DA6D8A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D958ECAE-0410-462B-BF2D-0FAB473F32CE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D958ECAE-0410-462B-BF2D-0FAB473F32CE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FCB69DC-57E4-46DB-805F-E3E747F6D012}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{22005FBF-3C18-4CBF-B473-3E27C1643E9A}\TypeLib\Version = "7.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E063117A-4B4B-481C-A22C-8B2FDB2D1A53}\ = "_cActiveTitleBar"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C7BD216-F558-41B3-B16A-34C832DB214C}\ = "_clsBrush"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FBD0810B-66C1-4CDD-B04B-CFB636A3B8E7}\TypeLib\ = "{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F2785BCD-069F-481D-85ED-13C0BC18E4A5}\ = "cImageProcessDIB"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.clsFunctions\Clsid\ = "{9BBC1C59-FF64-4D6A-9057-D35944A6BEA4}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77D32DB4-F032-4C17-A4D4-02379214F723}\TypeLib\ = "{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2BAFF457-D4A7-4C68-B96B-AE0DD37E4BF6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0386E025-6EDE-4EC6-B4E1-206D39614284}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FCB69DC-57E4-46DB-805F-E3E747F6D012}\ = "_cDIBShadowCreator"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DFEC2C61-6343-416F-80DD-DC3B2E8B3117}\ = "__cDIBSectionSave"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09A9D4DA-CA95-44D8-9FCD-2ACD1738D228}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AlphaDIB.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.clsBrush\Clsid\ = "{62032854-5345-4C30-82E5-A02C6FDA9DA3}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{043BC44E-D64A-43C4-A451-679829CB88E0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.cDIBShadowCreator\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FBD0810B-66C1-4CDD-B04B-CFB636A3B8E7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3582C51-3121-4E10-B7DC-EDFD4D8F21AE}\VERSION\ = "7.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E644DA2-5D1A-4CE9-9002-C93053815DC7}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2931F8C6-2AA0-4150-A984-E77207DD6649}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1919A3D-4620-4643-9534-4E1D8B456E22}\VERSION	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}\7.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EEE04923-F414-4EF1-9E42-949F71C8B347}\TypeLib\Version = "7.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EB64583-9422-4C0B-BC3A-A3B00497112D}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09A9D4DA-CA95-44D8-9FCD-2ACD1738D228}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F90FA753-BAEF-4A73-83FA-C90CE796D419}\VERSION\ = "7.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62032854-5345-4C30-82E5-A02C6FDA9DA3}\ = "AlphaDIB.clsBrush"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F2785BCD-069F-481D-85ED-13C0BC18E4A5}\ProxyStubClsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA8553CE-E4A9-4132-A316-EA24DEBFB7CA}\ = "24-bit Dib Section Class(BitmapCache)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AlphaDIB.clsJpeg\Clsid\ = "{23325226-DB03-4112-B6ED-2D3B0DBA712C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FCB69DC-57E4-46DB-805F-E3E747F6D012}\TypeLib\ = "{8392AEE0-DA0B-40F7-A296-C4C5A6937B28}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E30E45DE-14C3-4C39-8BFF-D97A2F6BB60B}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E30E45DE-14C3-4C39-8BFF-D97A2F6BB60B}\TypeLib\Version = "7.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{047FF39C-80C9-4F5E-800D-635EF4C63A36}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B3582C51-3121-4E10-B7DC-EDFD4D8F21AE}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC057A5F-F246-4A1A-8B60-8A4ACF6E3818}\ProxyStubClsid32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1160	1536	regsvr32.exe	81
PID 1536 wrote to memory of 1160	1536	regsvr32.exe	81
PID 1536 wrote to memory of 1160	1536	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AlphaDIB.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\AlphaDIB.dll
  2⤵
  - Modifies registry class
  PID:1160

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads