Overview
overview
8Static
static
8SAP-GUI-77...sk.txt
windows10-2004-x64
1SAP-GUI-77...sk.txt
windows11-21h2-x64
3SAP-GUI-77...sv.txt
windows10-2004-x64
1SAP-GUI-77...sv.txt
windows11-21h2-x64
3SAP-GUI-77...th.txt
windows10-2004-x64
1SAP-GUI-77...th.txt
windows11-21h2-x64
3SAP-GUI-77...zf.txt
windows10-2004-x64
1SAP-GUI-77...zf.txt
windows11-21h2-x64
3SAP-GUI-77...zh.txt
windows10-2004-x64
1SAP-GUI-77...zh.txt
windows11-21h2-x64
3SAP-GUI-77...rt.dll
windows10-2004-x64
3SAP-GUI-77...rt.dll
windows11-21h2-x64
3SAP-GUI-77...rt.zip
windows10-2004-x64
1SAP-GUI-77...rt.zip
windows11-21h2-x64
1SAP-GUI-77...ut.dll
windows10-2004-x64
3SAP-GUI-77...ut.dll
windows11-21h2-x64
3SAP-GUI-77...he.dll
windows10-2004-x64
3SAP-GUI-77...he.dll
windows11-21h2-x64
3SAP-GUI-77...r2.dll
windows10-2004-x64
3SAP-GUI-77...r2.dll
windows11-21h2-x64
3SAP-GUI-77...me.dll
windows10-2004-x64
3SAP-GUI-77...me.dll
windows11-21h2-x64
3SAP-GUI-77...og.dll
windows10-2004-x64
3SAP-GUI-77...og.dll
windows11-21h2-x64
3SAP-GUI-77...mp.dll
windows10-2004-x64
3SAP-GUI-77...mp.dll
windows11-21h2-x64
3SAP-GUI-77...fc.dll
windows10-2004-x64
3SAP-GUI-77...fc.dll
windows11-21h2-x64
3SAP-GUI-77...50.dll
windows10-2004-x64
1SAP-GUI-77...50.dll
windows11-21h2-x64
1SAP-GUI-77...50.dll
windows10-2004-x64
3SAP-GUI-77...50.dll
windows11-21h2-x64
3Analysis
- max time kernel
298s - max time network
205s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 13:31
Behavioral task
behavioral1
Sample
SAP-GUI-770/system/sap/lang/wdtllogsk.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
SAP-GUI-770/system/sap/lang/wdtllogsk.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
SAP-GUI-770/system/sap/lang/wdtllogsv.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
SAP-GUI-770/system/sap/lang/wdtllogsv.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
SAP-GUI-770/system/sap/lang/wdtllogth.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
SAP-GUI-770/system/sap/lang/wdtllogth.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
SAP-GUI-770/system/sap/lang/wdtllogzf.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
SAP-GUI-770/system/sap/lang/wdtllogzf.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
SAP-GUI-770/system/sap/lang/wdtllogzh.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
SAP-GUI-770/system/sap/lang/wdtllogzh.txt
Resource
win11-20250610-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
SAP-GUI-770/system/sap/sapchart.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
SAP-GUI-770/system/sap/sapchart.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
SAP-GUI-770/system/sap/sapchart.zip
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
SAP-GUI-770/system/sap/sapchart.zip
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
SAP-GUI-770/system/sap/sapfewut.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
SAP-GUI-770/system/sap/sapfewut.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
SAP-GUI-770/system/sap/sapfilecache.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
SAP-GUI-770/system/sap/sapfilecache.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
SAP-GUI-770/system/sap/saplgmgr2.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
SAP-GUI-770/system/sap/saplgmgr2.dll
Resource
win11-20250610-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
SAP-GUI-770/system/sap/sapmime.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
SAP-GUI-770/system/sap/sapmime.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
SAP-GUI-770/system/sap/wdtlog.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
SAP-GUI-770/system/sap/wdtlog.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
SAP-GUI-770/system/sapbtmp.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
SAP-GUI-770/system/sapbtmp.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
SAP-GUI-770/system/sapnwrfc.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
SAP-GUI-770/system/sapnwrfc.dll
Resource
win11-20250502-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
SAP-GUI-770/system/unicode/icudt50.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
SAP-GUI-770/system/unicode/icudt50.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
SAP-GUI-770/system/unicode/icuin50.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
SAP-GUI-770/system/unicode/icuin50.dll
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target SAP-GUI-770/system/sap/sapfewut.dll
- Size 317KB
- Sample260511-qssscabs2s
- SHA256 79e6077a00c3d680d53b3914dbd4719400781c16cb55ba49766979739e78cce3
- MD5 1c92ee34ea84bf621d49474e5c697ba1
- SHA1 592a100b811a2dcdb8c9c1e907d4820ab2114fe2
- SHA512 67db9751fe5938296e855d6eecbb2e1659fd212bf0585128ada07245e4711e910437052e85e124496442026ac5c7bb6766426b2195cff649dc41dc3aa4b620de
- SSDEEP 6144:fl2VU0Kwlv7VXLcZY7vq+6dmX5Hxrg7mtGX/IqIhIAwc2VxXX+hNAX7hYU:fl220/R7V7bgdA5HxkSAgqI+57X+07hH
- TLSH T182648D537F4051F2D5DE0238E9542E18D2BDAC604FD5C2D7E780AA8D2DB26C3963A2DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C7BF175-02CE-4A24-BF6B-1B50ACA0261C}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DD356D-02B6-4ae0-AC25-90F8991471B8}\ = "SapDirectories Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06A2B323-F717-43F8-8152-90D9AAA70457}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06A2B323-F717-43F8-8152-90D9AAA70457}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C7BF175-02CE-4A24-BF6B-1B50ACA0261C}\TypeLib\ = "{7CE2DCC3-4514-11D3-90E8-006094B9D64F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapDirectories\ = "SapDirectories Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapWorkDir\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapWorkDir\CurVer\ = "Sapfewut.SapWorkDir.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DD356D-02B6-4ae0-AC25-90F8991471B8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SAP-GUI-770\\system\\sap\\sapfewut.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33551D92-FC26-49E4-969D-D66CB438D2EA}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33551D92-FC26-49E4-969D-D66CB438D2EA}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapDirectories.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapWorkDir.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C7BF175-02CE-4A24-BF6B-1B50ACA0261C}\ = "SapWorkDir Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C7BF175-02CE-4A24-BF6B-1B50ACA0261C}\ProgID\ = "Sapfewut.SapWorkDir.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C7BF175-02CE-4A24-BF6B-1B50ACA0261C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SAP-GUI-770\\system\\sap\\sapfewut.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DD356D-02B6-4ae0-AC25-90F8991471B8}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06A2B323-F717-43F8-8152-90D9AAA70457}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06A2B323-F717-43F8-8152-90D9AAA70457}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapDirectories.1\ = "SapDirectories Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapDirectories\CurVer\ = "Sapfewut.SapDirectories.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7CE2DCC3-4514-11D3-90E8-006094B9D64F}\2.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33551D92-FC26-49E4-969D-D66CB438D2EA}\TypeLib\Version = "2.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DD356D-02B6-4ae0-AC25-90F8991471B8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DD356D-02B6-4ae0-AC25-90F8991471B8}\ProgID\ = "Sapfewut.SapDirectories.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7CE2DCC3-4514-11D3-90E8-006094B9D64F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33551D92-FC26-49E4-969D-D66CB438D2EA}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06A2B323-F717-43F8-8152-90D9AAA70457}\ = "ISapDirectories" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C7BF175-02CE-4A24-BF6B-1B50ACA0261C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C7BF175-02CE-4A24-BF6B-1B50ACA0261C}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7CE2DCC3-4514-11D3-90E8-006094B9D64F}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SAP-GUI-770\\system\\sap" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33551D92-FC26-49E4-969D-D66CB438D2EA} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapDirectories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapDirectories\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7CE2DCC3-4514-11D3-90E8-006094B9D64F}\2.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33551D92-FC26-49E4-969D-D66CB438D2EA}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33551D92-FC26-49E4-969D-D66CB438D2EA}\TypeLib\Version = "2.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06A2B323-F717-43F8-8152-90D9AAA70457} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06A2B323-F717-43F8-8152-90D9AAA70457}\TypeLib\ = "{7CE2DCC3-4514-11D3-90E8-006094B9D64F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C7BF175-02CE-4A24-BF6B-1B50ACA0261C}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DD356D-02B6-4ae0-AC25-90F8991471B8}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7CE2DCC3-4514-11D3-90E8-006094B9D64F}\2.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7CE2DCC3-4514-11D3-90E8-006094B9D64F}\2.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06A2B323-F717-43F8-8152-90D9AAA70457} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapDirectories.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapDirectories.1\CLSID\ = "{01DD356D-02B6-4ae0-AC25-90F8991471B8}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33551D92-FC26-49E4-969D-D66CB438D2EA}\ = "ISapWorkDir" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33551D92-FC26-49E4-969D-D66CB438D2EA}\TypeLib\ = "{7CE2DCC3-4514-11D3-90E8-006094B9D64F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DD356D-02B6-4ae0-AC25-90F8991471B8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33551D92-FC26-49E4-969D-D66CB438D2EA} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapWorkDir.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C7BF175-02CE-4A24-BF6B-1B50ACA0261C}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C7BF175-02CE-4A24-BF6B-1B50ACA0261C}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DD356D-02B6-4ae0-AC25-90F8991471B8}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7CE2DCC3-4514-11D3-90E8-006094B9D64F}\2.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapWorkDir\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Sapfewut.SapWorkDir\CLSID\ = "{0C7BF175-02CE-4A24-BF6B-1B50ACA0261C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33551D92-FC26-49E4-969D-D66CB438D2EA}\TypeLib\ = "{7CE2DCC3-4514-11D3-90E8-006094B9D64F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C7BF175-02CE-4A24-BF6B-1B50ACA0261C}\VersionIndependentProgID\ = "Sapfewut.SapWorkDir" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DD356D-02B6-4ae0-AC25-90F8991471B8}\VersionIndependentProgID\ = "Sapfewut.SapDirectories" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7CE2DCC3-4514-11D3-90E8-006094B9D64F}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SAP-GUI-770\\system\\sap\\sapfewut.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{06A2B323-F717-43F8-8152-90D9AAA70457}\TypeLib\ = "{7CE2DCC3-4514-11D3-90E8-006094B9D64F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DD356D-02B6-4ae0-AC25-90F8991471B8}\TypeLib\ = "{7CE2DCC3-4514-11D3-90E8-006094B9D64F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{06A2B323-F717-43F8-8152-90D9AAA70457}\TypeLib regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4956 wrote to memory of 3532 4956 regsvr32.exe 78
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\system\sap\sapfewut.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\system\sap\sapfewut.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3532
-