Overview
overview
3Static
static
3Class1.vbs
windows7-x64
1Class1.vbs
windows10-2004-x64
1Form1.vbs
windows7-x64
1Form1.vbs
windows10-2004-x64
1GoldButton.vbs
windows7-x64
1GoldButton.vbs
windows10-2004-x64
1ModMain.vbs
windows7-x64
1ModMain.vbs
windows10-2004-x64
1ModuleMultimedia.vbs
windows7-x64
1ModuleMultimedia.vbs
windows10-2004-x64
1Mp3HeaderTag.vbs
windows7-x64
1Mp3HeaderTag.vbs
windows10-2004-x64
1Player.vbs
windows7-x64
1Player.vbs
windows10-2004-x64
1Progybar.vbs
windows7-x64
1Progybar.vbs
windows10-2004-x64
1Xplayer.vbs
windows7-x64
1Xplayer.vbs
windows10-2004-x64
1Xplayer.dll
windows7-x64
1Xplayer.dll
windows10-2004-x64
1playerX.exe
windows7-x64
1playerX.exe
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 20:07
Static task
static1
Behavioral task
behavioral1
Sample
Class1.vbs
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
Class1.vbs
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Form1.vbs
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral4
Sample
Form1.vbs
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
GoldButton.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
GoldButton.vbs
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ModMain.vbs
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral8
Sample
ModMain.vbs
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
ModuleMultimedia.vbs
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral10
Sample
ModuleMultimedia.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Mp3HeaderTag.vbs
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral12
Sample
Mp3HeaderTag.vbs
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Player.vbs
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral14
Sample
Player.vbs
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Progybar.vbs
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral16
Sample
Progybar.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Xplayer.vbs
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
Xplayer.vbs
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Xplayer.dll
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral20
Sample
Xplayer.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
playerX.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral22
Sample
playerX.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
Xplayer.dll
-
Size
216KB
-
MD5
8b0cf816f706bcdd75fa7b28a059a75b
-
SHA1
4fe479bac3ebb3ea4bceaaf455f1b9c4d08f59df
-
SHA256
05a181ccfe0f091d4af9a601af5d5dba5ebfbf61f566e89750e9b7173eed746c
-
SHA512
450b4ba9223e601117f987689ebb6b2875f9962bac0e2a4fc40885161c3573b84ab9b6e26f12206942af4fde0f2764c2ab0a73a53668157eb03d06fcccfeb01d
-
SSDEEP
6144:O0mFqBjwd5G2IhI6oWX9gCo+SLzfUZDPJQvztoEA:ODkBjwjtMHoWXCX+6A
Malware Config
Signatures
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\MiscStatus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\TypeLib\ = "{A74DF9B6-95A3-11D4-9012-CF206198051B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F}\ = "_PlayerX" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F}\ = "_PlayerX" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\ = "__PlayerX" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F}\TypeLib\Version = "6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\ = "__PlayerX" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A74DF9B6-95A3-11D4-9012-CF206198051B}\6.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\ProgID\ = "XPlayer.PlayerX" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F}\TypeLib\ = "{A74DF9B6-95A3-11D4-9012-CF206198051B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\MiscStatus\1\ = "131473" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XPlayer.PlayerX regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A74DF9B6-95A3-11D4-9012-CF206198051B}\6.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A74DF9B6-95A3-11D4-9012-CF206198051B}\6.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Xplayer.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A74DF9B6-95A3-11D4-9012-CF206198051B}\6.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\TypeLib\ = "{A74DF9B6-95A3-11D4-9012-CF206198051B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A74DF9B6-95A3-11D4-9012-CF206198051B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A74DF9B6-95A3-11D4-9012-CF206198051B}\6.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\Control regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A74DF9B6-95A3-11D4-9012-CF206198051B}\6.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\TypeLib\Version = "6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F}\TypeLib\Version = "6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Xplayer.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A74DF9B6-95A3-11D4-9012-CF206198051B}\6.0\ = "XPlayer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\TypeLib\ = "{A74DF9B6-95A3-11D4-9012-CF206198051B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\Control\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\VERSION\ = "6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F}\ = "PlayerX" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A74DF9B6-95A3-11D4-9012-CF206198051B}\6.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\ = "PlayerX" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XPlayer.PlayerX\ = "XPlayer.PlayerX" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XPlayer.PlayerX\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A74DF9B6-95A3-11D4-9012-CF206198051B}\6.0\FLAGS\ = "2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8DF2E292-995D-11D4-9012-CA5FEB82D51F}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Xplayer.dll, 30000" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XPlayer.PlayerX\Clsid\ = "{8DF2E292-995D-11D4-9012-CA5FEB82D51F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DF2E33E-995D-11D4-9012-CA5FEB82D51F}\TypeLib\ = "{A74DF9B6-95A3-11D4-9012-CF206198051B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DF2E340-995D-11D4-9012-CA5FEB82D51F}\TypeLib\Version = "6.0" regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2324 wrote to memory of 4180 2324 regsvr32.exe 83 PID 2324 wrote to memory of 4180 2324 regsvr32.exe 83 PID 2324 wrote to memory of 4180 2324 regsvr32.exe 83