e200298313bb8a8578487fbbc5d407efc2a5b377ba1e667ecdd48423548e7dec

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e200298313bb8a8578487fbbc5d407efc2a5b377ba1e667ecdd48423548e7dec.dll
Size 457KB
Sample260427-evfp1sev2p
SHA256 e200298313bb8a8578487fbbc5d407efc2a5b377ba1e667ecdd48423548e7dec
MD5 4b00c95ad8857a09fb25dafdab883e94
SHA1 c3a29d93ac0be283395fb8b1237411cd7de2663b
SHA512 cecb2321efa3ae100f931008fb96876d65f87a86f4260735fcd3c3b4249939ce6c4d341e959de0e5cbf65442f97008de19db44a1aa7cce980896086ae251abf9
SSDEEP 12288:ruDWNnKD6qU31EXdIgBU+amG7nZYHkngNmr22IXi9GhZ2yVSHlMIDzqiYmgtFdSm:qDWNnKGqQ1EXdIgBU+amG7nZYHkngNmM
TLSH
T1F9A41A25F66384E5D42B0E701AAEF7BF862D7A62C834DD69E70CCA9D2F53970A530311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D6-BAFA-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl\ = "CDL: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file\CLSID = "{79eac9e7-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ftp\ = "ftp: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAA74EF9-8EE7-4659-88D9-F8C504DA73CC}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D6-BAFA-11CE-8C82-00AA004BA90B}\ = "IWinInetInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D6-BAFA-11CE-8C82-00AA004BA90B}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\ = "IUri"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\ = "IPersistMoniker"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file\ = "file:, local: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher\ = "gopher: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https\ = "https: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\deflate	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAA74EF9-8EE7-4659-88D9-F8C504DA73CC}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\ = "IAuthenticate"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\gopher\CLSID = "{79eac9e4-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\gzip	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D2-BAF9-11CE-8C82-00AA004BA90B}\ = "IHttpNegotiate"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C9-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\ = "IMonikerProp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}\ = "gopher: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\local\CLSID = "{79eac9e7-baf9-11ce-8c82-00aa004ba90b}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\https	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAA74EF9-8EE7-4659-88D9-F8C504DA73CC}\ = "IBindStatusCallbackEx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\NumMethods\ = "4"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD45F185-1B21-48E2-967B-EAD743A8914E}\ = "IZoneIdentifier"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD45F185-1B21-48E2-967B-EAD743A8914E}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\ = "IWinInetHttpInfo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D2-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\ = "IHttpNegotiate2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D8-BAFA-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CA5F7F-1847-4D87-9C5B-918509F7511D}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\file	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\ = "IBindStatusCallback"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F9F9FCB-E0F4-48EB-B7AB-FA2EA9365CB4}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E50292-A795-4117-8E09-2B560A72AC60}\NumMethods\ = "16"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C0-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD45F185-1B21-48E2-967B-EAD743A8914E}\NumMethods\ = "6"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F6B0360-B80D-11D0-A9B3-006097942311}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\lzdhtml\ = "AP Deflate Encoding/Decoding Filter"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A39EE748-6A27-4817-A6F2-13914BEF5890}\NumMethods\ = "28"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\NumMethods	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9D0-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FC4801A1-2BA9-11CF-A229-00AA003D7352}\NumMethods\ = "6"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\http\ = "http: Asynchronous Pluggable Protocol Handler"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9C1-BAF9-11CE-8C82-00AA004BA90B}\NumMethods\ = "11"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79EAC9EE-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F164EDF1-CC7C-4F0D-9A94-34222625C393}\NumMethods\ = "12"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD45F185-1B21-48E2-967B-EAD743A8914E}\ProxyStubClsid32\ = "{79EAC9F1-BAF9-11CE-8C82-00AA004BA90B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79EAC9E4-BAF9-11CE-8C82-00AA004BA90B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\cdl	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4540	4692	regsvr32.exe	79

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e200298313bb8a8578487fbbc5d407efc2a5b377ba1e667ecdd48423548e7dec.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\e200298313bb8a8578487fbbc5d407efc2a5b377ba1e667ecdd48423548e7dec.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RGIF656.tmp

Path C:\Users\Admin\AppData\Local\Temp\RGIF656.tmp
Size 19KB
SHA256 d3492df7e6f6cd369404a5c69bb958b2744367e729de5ef2a6729c37d7a0d940
MD5 50dcdfa8e48ed7084e739f53f7ed239e
SHA1 ecd0fde5ad093772cc69a130d534a44126765617
SHA512 189bf0a0fcadf88f8d55446e2fb581ea05afecacc4132943846c817b37206e2cfe63c05d3d12a715ad6c7dfa0bad93be1bdd86ee81a53847e7f17956685f8378
SSDEEP 384:XY/qNHA2BtKwX+9+6Z9Z6L9L6bMZ9Z6P9P6+9+67976k9k6o9o6L9L60906zkO9F:YYA7WJ/76ljYGZNyRuWJdiYIUH+RlKY0
TLSH
T174924239A068EF0DA00F3229629F3061F1DC28F9D15CFD6669DFA7BB5D88D494072786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4540-0-0x00000000754CE000-0x00000000754CF000-memory.dmp

Download

memory/4540-6-0x0000000000D40000-0x0000000000D65000-memory.dmp