f032591ff92ac9f36254adcab78f85d13f6c7559ecd0e7cb782d3c49db70ca1b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nEO iMAGING/NeoAgent.dll
Size

396KB
MD5

bd2e767384489e2da5a59ecbbae2dae5
SHA1

1040821f2c8127c425602917ab101cbffb37e1cd
SHA256

f0a1384a33b39ee8af42167ff5cdeb16d290ed019d767f5d97e43189afdfafab
SHA512

161e0b54951da828a23d13c69b0e1ef59572aa3fb85683d370192a0f8d032208866250394c3de4b1fdfac474ada83bf69fae9e9ac3454ccbb32ed25c54c44cea
SSDEEP

6144:4s7U2tfSZPLMu88mbWu9n0oL2FnCzmP3CBxTPxH+1Eg3/xQTMe5qEWl:/U2tfSZf/mbWA+nsOCBeEgPxGVF8

Score

1^/10

Malware Config

Signatures

Modifies registry class 39 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DF7112-A93D-4C4C-B086-D31D4ED5C4A4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NEOIMA~1\\NeoAgent.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DF7112-A93D-4C4C-B086-D31D4ED5C4A4}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{82F48A76-D479-4FF1-8F90-387A5E450E1E}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}\ = "IAgent"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DF7112-A93D-4C4C-B086-D31D4ED5C4A4}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{82F48A76-D479-4FF1-8F90-387A5E450E1E}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DF7112-A93D-4C4C-B086-D31D4ED5C4A4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NeoAgent.Agent	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NeoAgent.Agent\ = "Agent Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NeoAgent.Agent\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{82F48A76-D479-4FF1-8F90-387A5E450E1E}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DF7112-A93D-4C4C-B086-D31D4ED5C4A4}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{82F48A76-D479-4FF1-8F90-387A5E450E1E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{82F48A76-D479-4FF1-8F90-387A5E450E1E}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DF7112-A93D-4C4C-B086-D31D4ED5C4A4}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}\TypeLib\ = "{82F48A76-D479-4FF1-8F90-387A5E450E1E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}\TypeLib\ = "{82F48A76-D479-4FF1-8F90-387A5E450E1E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DF7112-A93D-4C4C-B086-D31D4ED5C4A4}\ = "Agent Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{82F48A76-D479-4FF1-8F90-387A5E450E1E}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E107BE72-BA17-4954-A139-E0E219238AA1}\ = "IAgent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DF7112-A93D-4C4C-B086-D31D4ED5C4A4}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DF7112-A93D-4C4C-B086-D31D4ED5C4A4}\TypeLib\ = "{82F48A76-D479-4FF1-8F90-387A5E450E1E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NeoAgent.Agent\Clsid\ = "{53DF7112-A93D-4C4C-B086-D31D4ED5C4A4}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DF7112-A93D-4C4C-B086-D31D4ED5C4A4}\ProgID\ = "NeoAgent.Agent"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{82F48A76-D479-4FF1-8F90-387A5E450E1E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nEO iMAGING\\NeoAgent.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{82F48A76-D479-4FF1-8F90-387A5E450E1E}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{82F48A76-D479-4FF1-8F90-387A5E450E1E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nEO iMAGING\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{82F48A76-D479-4FF1-8F90-387A5E450E1E}\1.0\ = "NeoAgent Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53DF7112-A93D-4C4C-B086-D31D4ED5C4A4}\InprocServer32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 2608	232	regsvr32.exe	86
PID 232 wrote to memory of 2608	232	regsvr32.exe	86
PID 232 wrote to memory of 2608	232	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\NeoAgent.dll"
1⤵
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\SysWOW64\regsvr32.exe
  /s "C:\Users\Admin\AppData\Local\Temp\nEO iMAGING\NeoAgent.dll"
  2⤵
  - Modifies registry class
  PID:2608

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads