Overview
overview
10Static
static
3HTCTL32.dll
windows7-x64
3HTCTL32.dll
windows10-2004-x64
3PCICHEK.dll
windows7-x64
3PCICHEK.dll
windows10-2004-x64
3PCICL32.dll
windows7-x64
3PCICL32.dll
windows10-2004-x64
3TCCTL32.dll
windows7-x64
3TCCTL32.dll
windows10-2004-x64
3cksini (2).exe
windows7-x64
3cksini (2).exe
windows10-2004-x64
3client32.exe
windows7-x64
10client32.exe
windows10-2004-x64
10false/vp8encoder.dll
windows7-x64
3false/vp8encoder.dll
windows10-2004-x64
3false/webmmux.dll
windows7-x64
3false/webmmux.dll
windows10-2004-x64
3msvcr100.dll
windows7-x64
3msvcr100.dll
windows10-2004-x64
3pcicapi.dll
windows7-x64
3pcicapi.dll
windows10-2004-x64
3remcmdstub.exe
windows7-x64
3remcmdstub.exe
windows10-2004-x64
3true/api-m...-0.dll
windows10-2004-x64
3true/vp8decoder.dll
windows7-x64
3true/vp8decoder.dll
windows10-2004-x64
3true/vp8encoder.dll
windows7-x64
3true/vp8encoder.dll
windows10-2004-x64
3true/webmmux.dll
windows7-x64
3true/webmmux.dll
windows10-2004-x64
3webmmux.dll
windows7-x64
3webmmux.dll
windows10-2004-x64
3webmvorbisencoder.dll
windows7-x64
3Analysis
-
max time kernel
12s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
07-01-2025 15:06
Static task
static1
Behavioral task
behavioral1
Sample
HTCTL32.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
HTCTL32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
PCICHEK.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
PCICHEK.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
PCICL32.dll
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
PCICL32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
TCCTL32.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
TCCTL32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
cksini (2).exe
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
cksini (2).exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
client32.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
client32.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
false/vp8encoder.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
false/vp8encoder.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
false/webmmux.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
false/webmmux.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
msvcr100.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
msvcr100.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
pcicapi.dll
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
pcicapi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
remcmdstub.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
remcmdstub.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
true/api-ms-win-core-localization-l1-2-0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
true/vp8decoder.dll
Resource
win7-20240729-en
Behavioral task
behavioral25
Sample
true/vp8decoder.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
true/vp8encoder.dll
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
true/vp8encoder.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
true/webmmux.dll
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
true/webmmux.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
webmmux.dll
Resource
win7-20241010-en
Behavioral task
behavioral31
Sample
webmmux.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
webmvorbisencoder.dll
Resource
win7-20240903-en
General
-
Target
webmmux.dll
-
Size
259KB
-
MD5
49c51ace274d7db13caa533880869a4a
-
SHA1
b539ed2f1a15e2d4e5c933611d736e0c317b8313
-
SHA256
1d6407d7c7ffd2642ea7f97c86100514e8e44f58ff522475cb42bcc43a1b172b
-
SHA512
13440009e2f63078dce466bf2fe54c60feb6cedeed6e9e6fc592189c50b0780543c936786b7051311089f39e9e3ccb67f705c54781c4cae6d3a8007998befbf6
-
SSDEEP
3072:MW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTl:MWSfr7sXSmPDbKPJ6/AsNk+1x
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F0-5211-11DF-94AF-0026B977EEAA}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.Muxer\ = "WebM Muxer Filter" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.Muxer\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.Muxer\CurVer\ = "Webm.Muxer.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.Muxer.1\ = "WebM Muxer Filter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F0-5211-11DF-94AF-0026B977EEAA}\ProgID\ = "Webm.Muxer.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F0-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\webmmux.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.Muxer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.Muxer.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F0-5211-11DF-94AF-0026B977EEAA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F0-5211-11DF-94AF-0026B977EEAA}\ = "WebM Muxer Filter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F0-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID\ = "Webm.Muxer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F0-5211-11DF-94AF-0026B977EEAA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.Muxer\CLSID\ = "{ED3110F0-5211-11DF-94AF-0026B977EEAA}" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F0-5211-11DF-94AF-0026B977EEAA}\FilterData = 020000000000200003000000000000003070693302000000000000000200000000000000000000003074793300000000a8000000b80000003174793300000000a8000000c80000003170693302000000000000000200000000000000000000003074793300000000d8000000e80000003174793300000000d8000000f8000000327069330800000000000000010000000000000000000000307479330000000008010000180100007669647300001000800000aa00389b715650383000001000800000aa00389b715650393000001000800000aa00389b716175647300001000800000aa00389b710bd12f8d41586b4a8905588fec1aded9ac66058ab342d94aaca393b906ddf98a83eb36e44f52ce119f530020af0ba770eb1031ed1152df1194af0026b977eeaa regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F0-5211-11DF-94AF-0026B977EEAA}\FriendlyName = "WebM Muxer Filter" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{ED3110F0-5211-11DF-94AF-0026B977EEAA}\CLSID = "{ED3110F0-5211-11DF-94AF-0026B977EEAA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F0-5211-11DF-94AF-0026B977EEAA} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F0-5211-11DF-94AF-0026B977EEAA}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ED3110F0-5211-11DF-94AF-0026B977EEAA}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.Muxer\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.Muxer.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Webm.Muxer.1\CLSID\ = "{ED3110F0-5211-11DF-94AF-0026B977EEAA}" regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2384 2248 regsvr32.exe 29 PID 2248 wrote to memory of 2384 2248 regsvr32.exe 29 PID 2248 wrote to memory of 2384 2248 regsvr32.exe 29 PID 2248 wrote to memory of 2384 2248 regsvr32.exe 29 PID 2248 wrote to memory of 2384 2248 regsvr32.exe 29 PID 2248 wrote to memory of 2384 2248 regsvr32.exe 29 PID 2248 wrote to memory of 2384 2248 regsvr32.exe 29
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\webmmux.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\webmmux.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2384
-