Overview
overview
3Static
static
3ade.exe
windows10-2004-x64
3ade.exe
windows11-21h2-x64
3adedata.dll
windows10-2004-x64
3adedata.dll
windows11-21h2-x64
3adesdata.dll
windows10-2004-x64
3adesdata.dll
windows11-21h2-x64
3client db maker.exe
windows10-2004-x64
3client db maker.exe
windows11-21h2-x64
3install.bat
windows10-2004-x64
3install.bat
windows11-21h2-x64
3srpclib.dll
windows10-2004-x64
3srpclib.dll
windows11-21h2-x64
3uninstall.bat
windows10-2004-x64
3uninstall.bat
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 12:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ade.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
adedata.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
adedata.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
adesdata.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
adesdata.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
client db maker.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
client db maker.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
install.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
install.bat
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
srpclib.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
srpclib.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
uninstall.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
uninstall.bat
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target adedata.dll
- Size 1.0MB
- Sample260604-pgdcvad181
- SHA256 2ac98fc5449a8357ed5ce4ff3c052d967a4828ba070ed87b42074964204544d2
- MD5 e6e13dbe157daf278dd82ea15c9ddec1
- SHA1 33600a2472d55d929f3b0fc04f805c9e6733fd9a
- SHA512 0ae5102e3b6fc07a7daa3ef8d9f113cf94863737eb8d817cb687ab1f8d57838b4fb1b2e1329ef0f6a8730778f31a8a69ce3f4073551e94a4b9936df614e09850
- SSDEEP 24576:2bLLX06ILw2H+UmVRNvgLGo2tm9qEm8kOu4dYjPX+xcRoOnQDqlzkMZUbn7fz0CY:CTnPktiKhYPB8/6
- TLSH T1C335E723A392E01FD54641712B2BF3EDA9292C3B1084651F7BC0DDAD2977EA3A835717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CED1E48E-87FB-472F-B0DD-E8F10D9BBCBB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\adeDataHandler.adeItemNoEquip regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56B7E003-4FA2-4F8E-8BC1-7E719BD2365A}\VERSION\ = "6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{284A0987-3DA1-4087-8FFD-074108B66DA5}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3F9E8AD3-A7C5-4476-A974-DB0B283269CF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB53A502-AF06-42CA-A74E-6D8C75A25DBA}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adeDataHandler.adeItemGiftBoxCol\Clsid\ = "{952DADDA-737F-459A-AB5E-7711710EA801}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{134B7676-4234-410B-88DC-73FAAD2EF052} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adeDataHandler.adeItemVioletBoxCol\Clsid\ = "{ADF07FFD-3A82-4BE6-9F38-FB81791566CF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adeDataHandler.adeItemScrollCol\Clsid\ = "{C6A47BD8-E52D-4A67-8F56-9DFD12F1DF75}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6602ECF-DC76-4627-ABF9-B3BCBD9F2C4D}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{530BE09F-1B12-4B45-8E70-246DA02D08D5}\TypeLib\Version = "6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{988EF6D5-C3D2-459C-9249-DB80E91E6026}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9792F938-9F21-45A2-B98D-A27662235248}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{93BEA8CC-5D01-4D77-9BAE-C7D0C500CB83}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{038B4A8E-CBF8-4B4D-BB58-28A73AF9B60C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\adedata.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{57FE649A-7834-4398-9F00-1B526B4F0F9F}\ = "adeProduceCol" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6602ECF-DC76-4627-ABF9-B3BCBD9F2C4D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\adedata.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E36EAC0-A2CF-463D-AEBB-B85E50C6F75B}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF71BDCF-1184-459C-AFBA-8A37CA7D0583}\ = "_adeItemMaterial" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{140F8246-A812-457B-8690-4CA79FF6661F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1253168-2933-4A97-9B61-AA6B1792678B}\TypeLib\ = "{AF037EB7-DB9A-4AA5-B097-249901CD07D9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9EF3426C-8528-4F61-A54E-8621DC071173}\TypeLib\ = "{AF037EB7-DB9A-4AA5-B097-249901CD07D9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9EF3426C-8528-4F61-A54E-8621DC071173}\TypeLib\Version = "6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67660959-519D-4BD9-AC47-CF8226F67352}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00D1F041-3902-428A-948E-097842CA065B}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13776261-5C03-40E8-A60D-02CAAE212C49} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{530BE09F-1B12-4B45-8E70-246DA02D08D5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{134B7676-4234-410B-88DC-73FAAD2EF052}\TypeLib\Version = "6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA51AFF5-11FD-4652-B1ED-0A51329C6AA0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B25824B-EAE6-494B-B79A-84643A7EAA7D}\ = "adeDataHandler.adeItemGroupDBEx" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BADE0677-8579-454B-B50A-D22C78B7112D}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{985ECE79-9161-490D-B3E9-782B9D12EAE2}\VERSION\ = "6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1685F41-D173-4BDE-9CA3-4ECF158237D7}\TypeLib\Version = "6.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{911FCC5D-78CD-471B-86F5-21CC6B46CDBF}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6327CA56-FDD5-4245-AAAF-AD21D862A3F0}\TypeLib\Version = "6.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{140F8246-A812-457B-8690-4CA79FF6661F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A10356B-3DBC-4C2D-8BA1-B5F1592EF15B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CAEE6527-281E-4930-914A-53AB2DE4CE3E}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{988EF6D5-C3D2-459C-9249-DB80E91E6026}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{988EF6D5-C3D2-459C-9249-DB80E91E6026}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5696FE7B-44CB-4FF3-9356-8604406428D0}\ = "_adeItemCardAlbum" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3959232A-C07A-4840-B9A8-D1D1116089AC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{140F8246-A812-457B-8690-4CA79FF6661F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01C913C7-D716-480F-AC86-375F21BB5966} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BADE0677-8579-454B-B50A-D22C78B7112D}\ = "adeDataHandler.adeItemFindingOre" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E4F79F0-B76F-473E-BB13-80FF96F096EB}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5696FE7B-44CB-4FF3-9356-8604406428D0}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6589189-A705-42C7-B743-DFFAE71EB439} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9ED661F-B59A-4258-B821-0BA838D3CAD5}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EDCD62F1-C99B-4F96-ACC7-1CB84EBA4851}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8EAA2F86-C205-4416-A7E3-BD41BA697D09}\TypeLib\ = "{AF037EB7-DB9A-4AA5-B097-249901CD07D9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{67660959-519D-4BD9-AC47-CF8226F67352} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adeDataHandler.adeItemGroupDBExCol\Clsid\ = "{00D1F041-3902-428A-948E-097842CA065B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adeDataHandler.adeSkillDBCol\ = "adeDataHandler.adeSkillDBCol" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3607543F-BB8D-4B76-ABCA-BB2C167F3D6D}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BBCD8E49-8C64-4683-ADDE-B3DEA52BB4F4}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6404005A-E5D3-4B9C-BEF1-767D54087F59}\TypeLib\ = "{AF037EB7-DB9A-4AA5-B097-249901CD07D9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F9E8AD3-A7C5-4476-A974-DB0B283269CF}\TypeLib\ = "{AF037EB7-DB9A-4AA5-B097-249901CD07D9}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AD5C233E-FEFF-4B3E-9C88-7803B3E67733}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adeDataHandler.adeItemClientDataCol\Clsid\ = "{F32E9646-F3C2-41E5-A5F4-EAE71AEEB82D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\adeDataHandler.adeSkillCore\ = "adeDataHandler.adeSkillCore" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{73556BE6-5B37-49A0-92BE-E1059996DADB}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F895BDC3-4213-454B-8D7F-B8D64FF7B2AA}\ProgID\ = "adeDataHandler.adeProduceCol" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1656 wrote to memory of 4300 1656 regsvr32.exe 80
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\adedata.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\adedata.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4300
-