Overview
overview
8Static
static
8SAP-GUI-77...sk.txt
windows10-2004-x64
1SAP-GUI-77...sk.txt
windows11-21h2-x64
3SAP-GUI-77...sv.txt
windows10-2004-x64
1SAP-GUI-77...sv.txt
windows11-21h2-x64
3SAP-GUI-77...th.txt
windows10-2004-x64
1SAP-GUI-77...th.txt
windows11-21h2-x64
3SAP-GUI-77...zf.txt
windows10-2004-x64
1SAP-GUI-77...zf.txt
windows11-21h2-x64
3SAP-GUI-77...zh.txt
windows10-2004-x64
1SAP-GUI-77...zh.txt
windows11-21h2-x64
3SAP-GUI-77...rt.dll
windows10-2004-x64
3SAP-GUI-77...rt.dll
windows11-21h2-x64
3SAP-GUI-77...rt.zip
windows10-2004-x64
1SAP-GUI-77...rt.zip
windows11-21h2-x64
1SAP-GUI-77...ut.dll
windows10-2004-x64
3SAP-GUI-77...ut.dll
windows11-21h2-x64
3SAP-GUI-77...he.dll
windows10-2004-x64
3SAP-GUI-77...he.dll
windows11-21h2-x64
3SAP-GUI-77...r2.dll
windows10-2004-x64
3SAP-GUI-77...r2.dll
windows11-21h2-x64
3SAP-GUI-77...me.dll
windows10-2004-x64
3SAP-GUI-77...me.dll
windows11-21h2-x64
3SAP-GUI-77...og.dll
windows10-2004-x64
3SAP-GUI-77...og.dll
windows11-21h2-x64
3SAP-GUI-77...mp.dll
windows10-2004-x64
3SAP-GUI-77...mp.dll
windows11-21h2-x64
3SAP-GUI-77...fc.dll
windows10-2004-x64
3SAP-GUI-77...fc.dll
windows11-21h2-x64
3SAP-GUI-77...50.dll
windows10-2004-x64
1SAP-GUI-77...50.dll
windows11-21h2-x64
1SAP-GUI-77...50.dll
windows10-2004-x64
3SAP-GUI-77...50.dll
windows11-21h2-x64
3Analysis
- max time kernel
298s - max time network
321s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 13:31
Behavioral task
behavioral1
Sample
SAP-GUI-770/system/sap/lang/wdtllogsk.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
SAP-GUI-770/system/sap/lang/wdtllogsk.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
SAP-GUI-770/system/sap/lang/wdtllogsv.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
SAP-GUI-770/system/sap/lang/wdtllogsv.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
SAP-GUI-770/system/sap/lang/wdtllogth.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
SAP-GUI-770/system/sap/lang/wdtllogth.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
SAP-GUI-770/system/sap/lang/wdtllogzf.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
SAP-GUI-770/system/sap/lang/wdtllogzf.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
SAP-GUI-770/system/sap/lang/wdtllogzh.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
SAP-GUI-770/system/sap/lang/wdtllogzh.txt
Resource
win11-20250610-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
SAP-GUI-770/system/sap/sapchart.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
SAP-GUI-770/system/sap/sapchart.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
SAP-GUI-770/system/sap/sapchart.zip
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
SAP-GUI-770/system/sap/sapchart.zip
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
SAP-GUI-770/system/sap/sapfewut.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
SAP-GUI-770/system/sap/sapfewut.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
SAP-GUI-770/system/sap/sapfilecache.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
SAP-GUI-770/system/sap/sapfilecache.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
SAP-GUI-770/system/sap/saplgmgr2.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
SAP-GUI-770/system/sap/saplgmgr2.dll
Resource
win11-20250610-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
SAP-GUI-770/system/sap/sapmime.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
SAP-GUI-770/system/sap/sapmime.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
SAP-GUI-770/system/sap/wdtlog.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
SAP-GUI-770/system/sap/wdtlog.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
SAP-GUI-770/system/sapbtmp.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
SAP-GUI-770/system/sapbtmp.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
SAP-GUI-770/system/sapnwrfc.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
SAP-GUI-770/system/sapnwrfc.dll
Resource
win11-20250502-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
SAP-GUI-770/system/unicode/icudt50.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
SAP-GUI-770/system/unicode/icudt50.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
SAP-GUI-770/system/unicode/icuin50.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
SAP-GUI-770/system/unicode/icuin50.dll
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target SAP-GUI-770/system/sap/sapchart.dll
- Size 5.8MB
- Sample260511-qssscabs2s
- SHA256 4d001f8b1143416a2179753278eb064d221c081ca61ecb660c47b40e5a856c90
- MD5 44ee5ab58746fe2f8d430e916cc3885e
- SHA1 174890a7f086197ded02786d353b481813d59fe6
- SHA512 c0a9bbda592d8b13dd5d9d3497eacc5fc4a0baaa666ae9ec9111443a76131f146ad9759ad0b787ee9c1650f5c952221348285f3554084b7c18417f03c0e46619
- SSDEEP 98304:f4750bq+hsjwm2K61wP0tNv7Iti2Muxf6FOSSmRlZbQawUCjmNL:Rbq+oHR61wPeEi2MuxfWOSS8lZbDFCat
- TLSH T100561870A5269075E8BA30F789BF6FD9B118595003D801C782A8BB69DB617F2FE311C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 63 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\MiscStatus\1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SAPGraphics.Chart.1\CLSID\ = "{5318DB4B-3B47-4ECD-85AE-C64B41587202}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SAP-GUI-770\\system\\sap\\sapchart.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8}\TypeLib\ = "{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SAPGraphics.Chart.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SAP-GUI-770\\system\\sap\\sapchart.dll, 1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E542CAB6-9D2B-4726-91B6-96CDEE6480D9} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17B60232-F020-493D-AAC9-283AC564210B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17B60232-F020-493D-AAC9-283AC564210B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17B60232-F020-493D-AAC9-283AC564210B}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8}\ = "_DChartControlEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8}\TypeLib\ = "{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17B60232-F020-493D-AAC9-283AC564210B}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}\1.0\ = "SAP Graphics Chart Control" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\MiscStatus\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\TypeLib\ = "{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}\1.0\HELPDIR\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17B60232-F020-493D-AAC9-283AC564210B}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}\1.0\FLAGS\ = "2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17B60232-F020-493D-AAC9-283AC564210B} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17B60232-F020-493D-AAC9-283AC564210B}\TypeLib\ = "{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17B60232-F020-493D-AAC9-283AC564210B}\TypeLib\ = "{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SAPGraphics.Chart.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SAPGraphics.Chart.1\Insertable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17B60232-F020-493D-AAC9-283AC564210B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\ = "SAP Chart Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\MiscStatus\1\ = "131473" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\Control\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E542CAB6-9D2B-4726-91B6-96CDEE6480D9}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17B60232-F020-493D-AAC9-283AC564210B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8}\ = "_DChartControlEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\ProgID\ = "SAPGraphics.Chart.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\Insertable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17B60232-F020-493D-AAC9-283AC564210B}\ = "_DChartControl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SAPGraphics.Chart.1\ = "SAP Chart Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SAP-GUI-770\\system\\sap\\sapchart.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5318DB4B-3B47-4ECD-85AE-C64B41587202}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17B60232-F020-493D-AAC9-283AC564210B}\ = "_DChartControl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17B60232-F020-493D-AAC9-283AC564210B}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17B60232-F020-493D-AAC9-283AC564210B}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B203AE1E-DBC0-4C53-8555-5EC239FB6DC8}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4704 wrote to memory of 5064 4704 regsvr32.exe 79
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\system\sap\sapchart.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\system\sap\sapchart.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5064
-