Overview
overview
3Static
static
3bin/advpack.dll
windows10-2004-x64
3bin/advpack.dll
windows11-21h2-x64
3bin/cnvcnt.dll
windows10-2004-x64
3bin/cnvcnt.dll
windows11-21h2-x64
3bin/cnvtoc.dll
windows10-2004-x64
3bin/cnvtoc.dll
windows11-21h2-x64
3bin/flash.exe
windows10-2004-x64
3bin/flash.exe
windows11-21h2-x64
3bin/gencnv.dll
windows10-2004-x64
3bin/gencnv.dll
windows11-21h2-x64
3bin/hha.dll
windows10-2004-x64
3bin/hha.dll
windows11-21h2-x64
3bin/hhc.exe
windows10-2004-x64
3bin/hhc.exe
windows11-21h2-x64
3bin/hhcout.dll
windows10-2004-x64
3bin/hhcout.dll
windows11-21h2-x64
3bin/hhkout.dll
windows10-2004-x64
3bin/hhkout.dll
windows11-21h2-x64
3bin/hhw.exe
windows10-2004-x64
3bin/hhw.exe
windows11-21h2-x64
3bin/iconv.dll
windows10-2004-x64
3bin/iconv.dll
windows11-21h2-x64
3bin/iconv.exe
windows10-2004-x64
3bin/iconv.exe
windows11-21h2-x64
3bin/itcc.dll
windows10-2004-x64
3bin/itcc.dll
windows11-21h2-x64
3bin/libexslt.dll
windows10-2004-x64
3bin/libexslt.dll
windows11-21h2-x64
3bin/libxml2.dll
windows10-2004-x64
3bin/libxml2.dll
windows11-21h2-x64
3bin/libxslt.dll
windows10-2004-x64
3bin/libxslt.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/04/2026, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
bin/advpack.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
bin/advpack.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
bin/cnvcnt.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
bin/cnvcnt.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
bin/cnvtoc.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
bin/cnvtoc.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
bin/flash.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
bin/flash.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
bin/gencnv.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
bin/gencnv.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
bin/hha.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
bin/hha.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
bin/hhc.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
bin/hhc.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
bin/hhcout.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
bin/hhcout.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
bin/hhkout.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
bin/hhkout.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
bin/hhw.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
bin/hhw.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
bin/iconv.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
bin/iconv.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
bin/iconv.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
bin/iconv.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
bin/itcc.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
bin/itcc.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
bin/libexslt.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
bin/libexslt.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
bin/libxml2.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
bin/libxml2.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
bin/libxslt.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
bin/libxslt.dll
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target bin/itcc.dll
- Size 150KB
- Sample260420-pldjeah14l
- SHA256 ef0f7aca8978b64f82aa55dbc7452c7a363f6d1dcd558f634b7249302520c09b
- MD5 120274c1c6fd1d784f53c6badda8583c
- SHA1 0cd8884ee9d00cfc45fecfff49ce2c3347914cfd
- SHA512 bd497ff82ec5641c956931ade6acd39d7ce16815f0567b3868b3a8e602982c89ceec8d8d464bed99bfebb131586d9756dfdd397eb6a40265b83432e15189901f
- SSDEEP 3072:Kc+bMQ97e6E9SUpRnRzfb4Iqslcv78QaLSZtj9NyF3wGo:EbMyqbSUpRnpEIqslcv78zSywGo
- TLSH T109E37E11F3C18176E1B3177B49BB3B75A779EA211526874F4310C9AA3D32B41AE3A327
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5AA-DEDF-11D0-9A61-00C04FB68BF7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5AB-DEDF-11D0-9A61-00C04FB68BF7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\itcc.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.SystemWordSink\CLSID\ = "{8FA0D5A9-DEDF-11D0-9A61-00C04FB68BF7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA2-D393-11D0-9A56-00C04FB68BF7}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA2-D393-11D0-9A56-00C04FB68BF7}\ProgID\ = "ITIR.CmdInt.4" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA2-D393-11D0-9A56-00C04FB68BF7}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.GroupBuild.4 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5AA-DEDF-11D0-9A61-00C04FB68BF7}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.WWFilterBuild.4\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5AB-DEDF-11D0-9A61-00C04FB68BF7}\VersionIndependentProgID\ = "ITIR.WWFilterBuild" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5A9-DEDF-11D0-9A61-00C04FB68BF7}\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA2-D393-11D0-9A56-00C04FB68BF7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA3-D393-11D0-9A56-00C04FB68BF7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA4-D393-11D0-9A56-00C04FB68BF7}\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5AA-DEDF-11D0-9A61-00C04FB68BF7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.WWFilterBuild.4 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5AB-DEDF-11D0-9A61-00C04FB68BF7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.SystemWordSink.4\CLSID\ = "{8FA0D5A9-DEDF-11D0-9A61-00C04FB68BF7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5A9-DEDF-11D0-9A61-00C04FB68BF7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA2-D393-11D0-9A56-00C04FB68BF7}\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.SvMgr.4\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA3-D393-11D0-9A56-00C04FB68BF7}\VersionIndependentProgID\ = "ITIR.SvMgr" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.FTIBuild\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5AA-DEDF-11D0-9A61-00C04FB68BF7}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5AB-DEDF-11D0-9A61-00C04FB68BF7}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.SystemWordSink.4\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5A9-DEDF-11D0-9A61-00C04FB68BF7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.CmdInt.4\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.SvMgr\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.SvMgr\CLSID\ = "{4662DAA3-D393-11D0-9A56-00C04FB68BF7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.FTIBuild.4 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.FTIBuild regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.FTIBuild\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.WWFilterBuild regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.SystemWordSink\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.WWFilterBuild\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.SystemWordSink.4 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA4-D393-11D0-9A56-00C04FB68BF7}\ProgID\ = "ITIR.GroupBuild.4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.WWFilterBuild\CLSID\ = "{8FA0D5AB-DEDF-11D0-9A61-00C04FB68BF7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5AB-DEDF-11D0-9A61-00C04FB68BF7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5A9-DEDF-11D0-9A61-00C04FB68BF7}\VersionIndependentProgID\ = "ITIR.SystemWordSink" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5A9-DEDF-11D0-9A61-00C04FB68BF7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\itcc.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.GroupBuild.4\CLSID\ = "{4662DAA4-D393-11D0-9A56-00C04FB68BF7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.GroupBuild\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA4-D393-11D0-9A56-00C04FB68BF7}\VersionIndependentProgID\ = "ITIR.GroupBuild" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5AA-DEDF-11D0-9A61-00C04FB68BF7}\ProgID\ = "ITIR.FTIBuild.4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA2-D393-11D0-9A56-00C04FB68BF7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\itcc.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.SvMgr.4\CLSID\ = "{4662DAA3-D393-11D0-9A56-00C04FB68BF7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA4-D393-11D0-9A56-00C04FB68BF7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA4-D393-11D0-9A56-00C04FB68BF7}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5AA-DEDF-11D0-9A61-00C04FB68BF7}\VersionIndependentProgID\ = "ITIR.FTIBuild" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.SystemWordSink regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.SystemWordSink\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA2-D393-11D0-9A56-00C04FB68BF7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA3-D393-11D0-9A56-00C04FB68BF7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bin\\itcc.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.WWFilterBuild.4\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5AB-DEDF-11D0-9A61-00C04FB68BF7}\ProgID\ = "ITIR.WWFilterBuild.4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.CmdInt.4\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.GroupBuild\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4662DAA4-D393-11D0-9A56-00C04FB68BF7}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.FTIBuild\CLSID\ = "{8FA0D5AA-DEDF-11D0-9A61-00C04FB68BF7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FA0D5A9-DEDF-11D0-9A61-00C04FB68BF7}\ProgID\ = "ITIR.SystemWordSink.4" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.CmdInt\CLSID\ = "{4662DAA2-D393-11D0-9A56-00C04FB68BF7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ITIR.SvMgr.4 regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4560 wrote to memory of 4384 4560 regsvr32.exe 83
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\bin\itcc.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\bin\itcc.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4384
-