Overview
overview
8Static
static
3Reserva.zip
windows10-2004-x64
8Reserva.zip
windows11-21h2-x64
1Instalar_Cliente.cmd
windows10-2004-x64
8Instalar_Cliente.cmd
windows11-21h2-x64
8Reserva_Nuvem_160.exe
windows10-2004-x64
3Reserva_Nuvem_160.exe
windows11-21h2-x64
3dbexpint.dll
windows10-2004-x64
3dbexpint.dll
windows11-21h2-x64
3gds32.dll
windows10-2004-x64
3gds32.dll
windows11-21h2-x64
3midas.dll
windows10-2004-x64
3midas.dll
windows11-21h2-x64
3reserva.ini
windows10-2004-x64
1reserva.ini
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/06/2026, 16:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Reserva.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
Reserva.zip
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Instalar_Cliente.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
Instalar_Cliente.cmd
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
Reserva_Nuvem_160.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Reserva_Nuvem_160.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
dbexpint.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
dbexpint.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
gds32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
gds32.dll
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
midas.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
midas.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
reserva.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
reserva.ini
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target midas.dll
- Size 289KB
- Sample260605-t4vmvsbs41
- SHA256 0b0edf7067ecb7a9554ffe5743fb65ba6e25c6407c137cb3657f7b8dd046138e
- MD5 a82285dda6f4778e5504fdf463f263e8
- SHA1 7d49097c362234e0bd991a8ab216733e98c70414
- SHA512 fcd6fa22906974ba0c87ae1dc8a04f29fa96cd8fd61d8d65029305c654dbbd67d553b0dca73bbaa816ca2bd36dec607d9a8f60f8c7aaae29fdac2a10f4fdd77f
- SSDEEP 6144:BeIZ5FcoGNQM4+hmwRtheDV2dyYjD9hYkn95myuj:BeKcofM4kAEx2
- TLSH T137546D11FC90C271C05101F05D39FB31797EAE656B2DA2873399B9AC9FB2360AB4275B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase.1\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\midas.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\ProgID\ = "Borland.Midas_DatapacketRead.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1\Clsid\ = "{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ = "IAppServer" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\midas.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\ProgID\ = "Borland.Midas_DSBase.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\ = "Borland Midas type library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\midas.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\ProgID\ = "Borland.Midas_DSCursor.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\ = "Borland Midas DSCursor 1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketRead.1\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\midas.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor.1\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor.1\Clsid\ = "{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\VersionIndependentProgID\ = "Borland.Midas_DSCursor" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\Clsid\ = "{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ = "IAppServer" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\CurVer\ = "Borland.Midas_DSBase.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\CurVer\ = "Borland.Midas_DSCursor.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\ = "Borland Midas DatapacketRead" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketRead.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1\ = "Borland Midas DatapacketWrite" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\ = "Borland Midas DSBase Current" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase.1\ = "Borland Midas DSBase 1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketRead.1\ = "Borland Midas DatapacketRead" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketRead.1\Clsid\ = "{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\ProgID\ = "Borland.Midas_DatapacketWrite.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\ = "Borland Midas DSBase 1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\VersionIndependentProgID\ = "Borland.Midas_DSBase" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib\ = "{83F57D68-CA9A-11D2-9088-00C04FA35CFA}" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4944 wrote to memory of 5100 4944 regsvr32.exe 80
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\midas.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\midas.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5100
-