Overview
overview
8Static
static
8SAP-GUI-77...sk.txt
windows10-2004-x64
1SAP-GUI-77...sk.txt
windows11-21h2-x64
3SAP-GUI-77...sv.txt
windows10-2004-x64
1SAP-GUI-77...sv.txt
windows11-21h2-x64
3SAP-GUI-77...th.txt
windows10-2004-x64
1SAP-GUI-77...th.txt
windows11-21h2-x64
3SAP-GUI-77...zf.txt
windows10-2004-x64
1SAP-GUI-77...zf.txt
windows11-21h2-x64
3SAP-GUI-77...zh.txt
windows10-2004-x64
1SAP-GUI-77...zh.txt
windows11-21h2-x64
3SAP-GUI-77...rt.dll
windows10-2004-x64
3SAP-GUI-77...rt.dll
windows11-21h2-x64
3SAP-GUI-77...rt.zip
windows10-2004-x64
1SAP-GUI-77...rt.zip
windows11-21h2-x64
1SAP-GUI-77...ut.dll
windows10-2004-x64
3SAP-GUI-77...ut.dll
windows11-21h2-x64
3SAP-GUI-77...he.dll
windows10-2004-x64
3SAP-GUI-77...he.dll
windows11-21h2-x64
3SAP-GUI-77...r2.dll
windows10-2004-x64
3SAP-GUI-77...r2.dll
windows11-21h2-x64
3SAP-GUI-77...me.dll
windows10-2004-x64
3SAP-GUI-77...me.dll
windows11-21h2-x64
3SAP-GUI-77...og.dll
windows10-2004-x64
3SAP-GUI-77...og.dll
windows11-21h2-x64
3SAP-GUI-77...mp.dll
windows10-2004-x64
3SAP-GUI-77...mp.dll
windows11-21h2-x64
3SAP-GUI-77...fc.dll
windows10-2004-x64
3SAP-GUI-77...fc.dll
windows11-21h2-x64
3SAP-GUI-77...50.dll
windows10-2004-x64
1SAP-GUI-77...50.dll
windows11-21h2-x64
1SAP-GUI-77...50.dll
windows10-2004-x64
3SAP-GUI-77...50.dll
windows11-21h2-x64
3Analysis
- max time kernel
298s - max time network
321s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 13:31
Behavioral task
behavioral1
Sample
SAP-GUI-770/system/sap/lang/wdtllogsk.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
SAP-GUI-770/system/sap/lang/wdtllogsk.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
SAP-GUI-770/system/sap/lang/wdtllogsv.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
SAP-GUI-770/system/sap/lang/wdtllogsv.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
SAP-GUI-770/system/sap/lang/wdtllogth.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
SAP-GUI-770/system/sap/lang/wdtllogth.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
SAP-GUI-770/system/sap/lang/wdtllogzf.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
SAP-GUI-770/system/sap/lang/wdtllogzf.txt
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
SAP-GUI-770/system/sap/lang/wdtllogzh.txt
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
SAP-GUI-770/system/sap/lang/wdtllogzh.txt
Resource
win11-20250610-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
SAP-GUI-770/system/sap/sapchart.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
SAP-GUI-770/system/sap/sapchart.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
SAP-GUI-770/system/sap/sapchart.zip
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
SAP-GUI-770/system/sap/sapchart.zip
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
SAP-GUI-770/system/sap/sapfewut.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
SAP-GUI-770/system/sap/sapfewut.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
SAP-GUI-770/system/sap/sapfilecache.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
SAP-GUI-770/system/sap/sapfilecache.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
SAP-GUI-770/system/sap/saplgmgr2.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
SAP-GUI-770/system/sap/saplgmgr2.dll
Resource
win11-20250610-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
SAP-GUI-770/system/sap/sapmime.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
SAP-GUI-770/system/sap/sapmime.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
SAP-GUI-770/system/sap/wdtlog.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
SAP-GUI-770/system/sap/wdtlog.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
SAP-GUI-770/system/sapbtmp.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
SAP-GUI-770/system/sapbtmp.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
SAP-GUI-770/system/sapnwrfc.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
SAP-GUI-770/system/sapnwrfc.dll
Resource
win11-20250502-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
SAP-GUI-770/system/unicode/icudt50.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
SAP-GUI-770/system/unicode/icudt50.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
SAP-GUI-770/system/unicode/icuin50.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
SAP-GUI-770/system/unicode/icuin50.dll
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target SAP-GUI-770/system/sap/wdtlog.dll
- Size 715KB
- Sample260511-qssscabs2s
- SHA256 b8b9edf6f3edee34e5c98f6af76c98c6c420ac3095f300dab24f0eb90c25a111
- MD5 d224c49a9794666ab52f43c17564fbfd
- SHA1 fa50c24cf5d1b4bbac7d119ae19946cc953e26b3
- SHA512 7d29fb21016ca53e71c287bb1dd53666bdbf9835455cf426fd8e4d02f065b77cb52e5394331850592e024f7d27d1439af20e9dfc988f75fde9551cf2949baa92
- SSDEEP 12288:7UN0A2epYqXdyKguzBMH0ZHtvwhdEfwTenrzH3bD/skHNu+4yCZUpqmq1CNS9js1:FuzamHIbZBPns7r3FNV
- TLSH T1C6F43BE23905D639EA9F4273DCED957E012EBD50072064C793893ABE29F93D22731A47
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\Control\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2D74A49-184A-11CF-8984-0000E8A49FA0}\TypeLib\ = "{B24944D9-1501-11CF-8981-0000E8A49FA0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2D74A49-184A-11CF-8984-0000E8A49FA0}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AAF88AD8-1F50-11CF-8988-0000E8A49FA0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SAP.LogonControl.1\ = "SAP Logon Control" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\Version\ = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SAP.LogonControl.1\Insertable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B24944D8-1501-11CF-8981-0000E8A49FA0}\TypeLib\ = "{B24944D9-1501-11CF-8981-0000E8A49FA0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B24944D8-1501-11CF-8981-0000E8A49FA0}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2D74A49-184A-11CF-8984-0000E8A49FA0}\ = "_CSAPLogonConnection" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\ProgID\ = "SAP.LogonControl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B24944D9-1501-11CF-8981-0000E8A49FA0}\1.1\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2D74A49-184A-11CF-8984-0000E8A49FA0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\TypeLib\ = "{B24944D9-1501-11CF-8981-0000E8A49FA0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B24944D7-1501-11CF-8981-0000E8A49FA0}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B24944D8-1501-11CF-8981-0000E8A49FA0}\TypeLib\Version = "1.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\ = "SAP Logon Control" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B24944D9-1501-11CF-8981-0000E8A49FA0}\1.1\FLAGS\ = "2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2D74A49-184A-11CF-8984-0000E8A49FA0}\TypeLib\ = "{B24944D9-1501-11CF-8981-0000E8A49FA0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\MiscStatus\1\ = "135569" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B24944D9-1501-11CF-8981-0000E8A49FA0}\1.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B24944D7-1501-11CF-8981-0000E8A49FA0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B24944D7-1501-11CF-8981-0000E8A49FA0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B24944D8-1501-11CF-8981-0000E8A49FA0}\TypeLib\Version = "1.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944DA-1501-11CF-8981-0000E8A49FA0}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SAP.LogonControl.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SAP.LogonControl.1\CLSID\ = "{B24944D6-1501-11CF-8981-0000E8A49FA0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B24944D9-1501-11CF-8981-0000E8A49FA0}\1.1\ = "SAP Logon Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B24944D7-1501-11CF-8981-0000E8A49FA0}\ = "_CSAPLogonControl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B24944D8-1501-11CF-8981-0000E8A49FA0}\ = "_CSAPLogonControlEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2D74A49-184A-11CF-8984-0000E8A49FA0}\ = "_CSAPLogonConnection" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B24944D9-1501-11CF-8981-0000E8A49FA0}\1.1\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B24944D9-1501-11CF-8981-0000E8A49FA0}\1.1\HELPDIR\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B24944D8-1501-11CF-8981-0000E8A49FA0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B24944D8-1501-11CF-8981-0000E8A49FA0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\InprocServer32\ThreadingModel = "both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B24944D9-1501-11CF-8981-0000E8A49FA0}\1.1\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B24944D7-1501-11CF-8981-0000E8A49FA0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B24944D7-1501-11CF-8981-0000E8A49FA0}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B24944D8-1501-11CF-8981-0000E8A49FA0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B24944D8-1501-11CF-8981-0000E8A49FA0}\TypeLib\ = "{B24944D9-1501-11CF-8981-0000E8A49FA0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2D74A49-184A-11CF-8984-0000E8A49FA0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AAF88AD8-1F50-11CF-8988-0000E8A49FA0}\ = "SAP Logon User Property Page" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B24944D7-1501-11CF-8981-0000E8A49FA0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B24944D8-1501-11CF-8981-0000E8A49FA0}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944DA-1501-11CF-8981-0000E8A49FA0}\ = "SAP Logon System Property Page" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\Insertable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B24944D7-1501-11CF-8981-0000E8A49FA0}\TypeLib\ = "{B24944D9-1501-11CF-8981-0000E8A49FA0}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B24944D8-1501-11CF-8981-0000E8A49FA0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2D74A49-184A-11CF-8984-0000E8A49FA0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944DA-1501-11CF-8981-0000E8A49FA0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SAP-GUI-770\\system\\sap\\wdtlog.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B24944D9-1501-11CF-8981-0000E8A49FA0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B24944D9-1501-11CF-8981-0000E8A49FA0}\1.1\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SAP-GUI-770\\system\\sap\\wdtlog.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B24944D8-1501-11CF-8981-0000E8A49FA0}\ = "_CSAPLogonControlEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B24944D6-1501-11CF-8981-0000E8A49FA0}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B24944D7-1501-11CF-8981-0000E8A49FA0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B24944D7-1501-11CF-8981-0000E8A49FA0}\ProxyStubClsid32 regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1660 wrote to memory of 1108 1660 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\system\sap\wdtlog.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\SAP-GUI-770\system\sap\wdtlog.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1108
-