43920a20626a75e1da4f04d7cfb399480555200543a1205615cd18e37ea188d1

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

QQLive/Common.dll
Size

1.5MB
MD5

7587cf65eba4e9eba2bc1d2d08d56735
SHA1

93a4e0cc9e88e9040939b7a78a68ad946e573d00
SHA256

66f76c269b539ea8fb41f671670028632d9b5e06b46556cf0e0624e84dc65685
SHA512

384a3b08e2f3c7e660d49b200f58f991f09bddce15acfc52a060630c1539ddcc909133b9e516407dff7e32c01df85d4f0bd8fef12dd62b2a91a5a94f2962a410
SSDEEP

24576:kEmbsj7hamVW9Tj64/CG56VDRG/jvbXKUsTx8CujsbX7oh:kEUy7hamVW9JCG565ULuUsTCCb7oh

Score

1^/10

Malware Config

Signatures

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6517DD27-EA6F-4947-9DEA-F9C487BB1020}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C3F29CA-F983-4897-A545-2221773BC5A6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{993196BC-CCB2-440A-9F92-4B39E1F5AF53}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{993196BC-CCB2-440A-9F92-4B39E1F5AF53}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{993196BC-CCB2-440A-9F92-4B39E1F5AF53}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Common.dll	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6517DD27-EA6F-4947-9DEA-F9C487BB1020}\1.0\ = "TXCommon 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6517DD27-EA6F-4947-9DEA-F9C487BB1020}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{993196BC-CCB2-440A-9F92-4B39E1F5AF53}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{6517DD27-EA6F-4947-9DEA-F9C487BB1020}\ = "TXIM"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6517DD27-EA6F-4947-9DEA-F9C487BB1020}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04AD9AE4-F179-4A7B-A640-0CB8EA74A071}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{993196BC-CCB2-440A-9F92-4B39E1F5AF53}\ = "ITXDataRead"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{993196BC-CCB2-440A-9F92-4B39E1F5AF53}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{993196BC-CCB2-440A-9F92-4B39E1F5AF53}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C3F29CA-F983-4897-A545-2221773BC5A6}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6517DD27-EA6F-4947-9DEA-F9C487BB1020}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04AD9AE4-F179-4A7B-A640-0CB8EA74A071}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C3F29CA-F983-4897-A545-2221773BC5A6}\ = "ITXData"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C3F29CA-F983-4897-A545-2221773BC5A6}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04AD9AE4-F179-4A7B-A640-0CB8EA74A071}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C3F29CA-F983-4897-A545-2221773BC5A6}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}\ = "ITXArrayRead"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}\ = "ITXArrayRead"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45B22163-C1A9-483D-9657-0B6E8CA607C9}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C3F29CA-F983-4897-A545-2221773BC5A6}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04AD9AE4-F179-4A7B-A640-0CB8EA74A071}\ = "ITXBuffer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04AD9AE4-F179-4A7B-A640-0CB8EA74A071}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C3F29CA-F983-4897-A545-2221773BC5A6}\TypeLib\ = "{6517DD27-EA6F-4947-9DEA-F9C487BB1020}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C3F29CA-F983-4897-A545-2221773BC5A6}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C3F29CA-F983-4897-A545-2221773BC5A6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04AD9AE4-F179-4A7B-A640-0CB8EA74A071}\ = "ITXBuffer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}\TypeLib\ = "{6517DD27-EA6F-4947-9DEA-F9C487BB1020}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6517DD27-EA6F-4947-9DEA-F9C487BB1020}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QQLive\\Common.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04AD9AE4-F179-4A7B-A640-0CB8EA74A071}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C3F29CA-F983-4897-A545-2221773BC5A6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45B22163-C1A9-483D-9657-0B6E8CA607C9}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45B22163-C1A9-483D-9657-0B6E8CA607C9}\TypeLib\ = "{6517DD27-EA6F-4947-9DEA-F9C487BB1020}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\Common.dll\AppID = "{6517DD27-EA6F-4947-9DEA-F9C487BB1020}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{04AD9AE4-F179-4A7B-A640-0CB8EA74A071}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{993196BC-CCB2-440A-9F92-4B39E1F5AF53}\TypeLib\ = "{6517DD27-EA6F-4947-9DEA-F9C487BB1020}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45B22163-C1A9-483D-9657-0B6E8CA607C9}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6517DD27-EA6F-4947-9DEA-F9C487BB1020}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6517DD27-EA6F-4947-9DEA-F9C487BB1020}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{993196BC-CCB2-440A-9F92-4B39E1F5AF53}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45B22163-C1A9-483D-9657-0B6E8CA607C9}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{993196BC-CCB2-440A-9F92-4B39E1F5AF53}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}\TypeLib\ = "{6517DD27-EA6F-4947-9DEA-F9C487BB1020}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C3F29CA-F983-4897-A545-2221773BC5A6}\ = "ITXData"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6517DD27-EA6F-4947-9DEA-F9C487BB1020}\1.0\HELPDIR\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C3F29CA-F983-4897-A545-2221773BC5A6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{993196BC-CCB2-440A-9F92-4B39E1F5AF53}\TypeLib\ = "{6517DD27-EA6F-4947-9DEA-F9C487BB1020}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{40CBD107-7733-4280-B059-19ED37D1AA20}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45B22163-C1A9-483D-9657-0B6E8CA607C9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45B22163-C1A9-483D-9657-0B6E8CA607C9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45B22163-C1A9-483D-9657-0B6E8CA607C9}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 1972	3628	regsvr32.exe	84
PID 3628 wrote to memory of 1972	3628	regsvr32.exe	84
PID 3628 wrote to memory of 1972	3628	regsvr32.exe	84

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\QQLive\Common.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\QQLive\Common.dll
  2⤵
  - Modifies registry class
  PID:1972

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads