Overview
overview
10Static
static
5RoleX-BootV2.exe
windows10-2004-x64
10local_bin/...PO.dll
windows10-2004-x64
7local_bin/...PO.dll
windows11-21h2-x64
7local_bin/Qt5Core.dll
windows10-2004-x64
1local_bin/Qt5Core.dll
windows11-21h2-x64
1local_bin/...-3.dll
windows10-2004-x64
1local_bin/...-3.dll
windows11-21h2-x64
1local_bin/...-1.dll
windows10-2004-x64
1local_bin/...-1.dll
windows11-21h2-x64
1local_bin/...40.dll
windows10-2004-x64
1local_bin/...40.dll
windows11-21h2-x64
1local_bin/..._1.dll
windows10-2004-x64
3local_bin/..._1.dll
windows11-21h2-x64
1local_bin/...47.dll
windows10-2004-x64
3local_bin/...47.dll
windows11-21h2-x64
3local_bin/...v2.dll
windows10-2004-x64
3local_bin/...v2.dll
windows11-21h2-x64
3mpclient.dll
windows10-2004-x64
10mpclient.dll
windows11-21h2-x64
10presets/DDSPreview.py
windows10-2004-x64
3presets/DDSPreview.py
windows11-21h2-x64
3presets/FN...hes.py
windows10-2004-x64
3presets/FN...hes.py
windows11-21h2-x64
3presets/FNISTool.py
windows10-2004-x64
3presets/FNISTool.py
windows11-21h2-x64
3presets/FN...set.py
windows10-2004-x64
3presets/FN...set.py
windows11-21h2-x64
3presets/Fo...ker.py
windows10-2004-x64
3presets/Fo...ker.py
windows11-21h2-x64
3presets/ch...is.dll
windows10-2004-x64
1presets/ch...is.dll
windows11-21h2-x64
1presets/di...ic.dll
windows10-2004-x64
1Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/05/2026, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
RoleX-BootV2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
local_bin/EqualizerAPO.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
local_bin/EqualizerAPO.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
local_bin/Qt5Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
local_bin/Qt5Core.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
local_bin/libfftw3f-3.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
local_bin/libfftw3f-3.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
local_bin/libsndfile-1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
local_bin/libsndfile-1.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
local_bin/msvcp140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
local_bin/msvcp140.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
local_bin/msvcp140_1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
local_bin/msvcp140_1.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
local_bin/temp/d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
local_bin/temp/d3dcompiler_47.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
local_bin/temp/libGLESv2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
local_bin/temp/libGLESv2.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
mpclient.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
mpclient.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral20
Sample
presets/DDSPreview.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
presets/DDSPreview.py
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral22
Sample
presets/FNISPatches.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
presets/FNISPatches.py
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
presets/FNISTool.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
presets/FNISTool.py
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
presets/FNISToolReset.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
presets/FNISToolReset.py
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
presets/Form43Checker.py
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
presets/Form43Checker.py
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
presets/check_fnis.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
presets/check_fnis.dll
Resource
win11-20260513-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
presets/diagnose_basic.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target local_bin/EqualizerAPO.dll
- Size 599KB
- Sample260525-e39ytsa15r
- SHA256 2cb094f9a14dad89d9acf29fae4b6e036d8896b7e8eac52d010248a31006fb1d
- MD5 3f96577baa37bf625bb350776a91296b
- SHA1 cb9150ed61774b428ee3c55b7ab61be62baa8e8a
- SHA512 62fe6ead155c9a176fe90bc2bbb848e9afa7d760add8b2d5e5ea1522997cc05c83d138ed1281d4c047599363f1658117070b85e425b4f3df3afee86bcd1a8e6d
- SSDEEP 12288:3ruD49udWGn9SNMbrS456F+upz31+s5TiaN0a:3ruD4sdzt3p3o71LTiaNR
- TLSH T12BD41906A2A903A8D0BBD27C8AA79912F7B678050775D6CF1391426B1F23BD1DF3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC1CC9CE-FAED-4822-828A-82A81A6F018F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\FriendlyName = "EqualizerAPO" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\MinInputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\MinOutputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\MaxOutputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\MaxInputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\MaxOutputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\MinorVersion = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\MajorVersion = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\Copyright = "Copyright (C) 2015" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\MaxInputConnections = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\NumAPOInterfaces = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\MinorVersion = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\local_bin\\EqualizerAPO.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\Flags = "13" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\NumAPOInterfaces = "1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\Copyright = "Copyright (C) 2015" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\MinInputConnections = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\local_bin\\EqualizerAPO.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\ = "EqualizerAPO Pre-Mix Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\MajorVersion = "1" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\Flags = "13" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\APOInterface0 = "{FD7F2B29-24D0-4B5C-B177-592C39F9CA10}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\FriendlyName = "EqualizerAPO" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\MaxInstances = "4294967295" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\ = "EqualizerAPO Post-Mix Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EACD2258-FCAC-4FF4-B36D-419E924A6D79} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EC1CC9CE-FAED-4822-828A-82A81A6F018F}\MaxInstances = "4294967295" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioEngine\AudioProcessingObjects\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\MinOutputConnections = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EACD2258-FCAC-4FF4-B36D-419E924A6D79}\InprocServer32 regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\local_bin\EqualizerAPO.dll1⤵
- Modifies registry class
PID:4428
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2212