3aea7342a1cf46f6b6cdd9b120831621a848765a2b6d27f192e47c17f5da93cf

Analysis

max time kernel
298s
max time network
260s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/07/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tempdir.dll
Size 8.4MB
Sample260705-te9eqahs8m
SHA256 3aea7342a1cf46f6b6cdd9b120831621a848765a2b6d27f192e47c17f5da93cf
MD5 94dc8225b32c0dad2d7623f956944cae
SHA1 607af831161b910a3261199dd38335ae8411d2a1
SHA512 f6fd76c322887324ceea49236060c27676cfb2abb46d278b85d7ec30ac25670ce71c9eb677a3a9521252797d4086c0b827626d398aa4d02adf8236d4b58412d9
SSDEEP 49152:gVz9KcBToaRdLwHeXOVfFFsP84xE3P+GX4u28VVcnVbyGf5NwnX2kSn4COI9jmTl:45nrwzYPFx4Gq2G6+GMnX2XaDx3
TLSH
T1F89633DE65167208D9192CFDC91A764F34E7BAF3221A1B1887368627231893C6F37E74
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2504	regsvr32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4932-0-0x00007FF8E3760000-0x00007FF8E3BD6000-memory.dmp	upx
behavioral2/memory/4932-2-0x00007FF8E3760000-0x00007FF8E3BD6000-memory.dmp	upx
behavioral2/memory/4932-5-0x00007FF8E3760000-0x00007FF8E3BD6000-memory.dmp	upx

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	regsvr32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	regsvr32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 2504	4932	regsvr32.exe	90

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\tempdir.dll
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4932
- C:\ProgramData\DarkSeaGreenChartreuse\regsvr32.exe
  "C:\ProgramData\DarkSeaGreenChartreuse\regsvr32.exe"
  2⤵
  - Executes dropped EXE
  PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

regsvr32.exe

Path C:\ProgramData\DarkSeaGreenChartreuse\regsvr32.exe
Size 24KB
SHA256 022cb167a29a32dae848be91aef721c74f1975af151807dafcc5ed832db246b7
MD5 b0c2fa35d14a9fad919e99d9d75e1b9e
SHA1 8d7c2fd354363daee63e8f591ec52fa5d0e23f6f
SHA512 a6155e42b605425914d1bf745d9b2b5ed57976e161384731c6821a1f8fa2bc3207a863ae45d6ad371ac82733b72bb024204498baa4fb38ad46c6d7bc52e5a022
SSDEEP 384:n5Y3wBQ8l/m60z+G7XU9I6ExBOMDl16AvcX9dp/Ql7YQCrA2WrcLHW:n5Yg3l/mTRXU9FeGpX9dp/47tCnL
TLSH
T1C4B21A0897EA2499E5BA973998F31225D771353117014FFF39E4823A0F22BD19E36F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4932-0-0x00007FF8E3760000-0x00007FF8E3BD6000-memory.dmp

Download

memory/4932-2-0x00007FF8E3760000-0x00007FF8E3BD6000-memory.dmp

Download

memory/4932-5-0x00007FF8E3760000-0x00007FF8E3BD6000-memory.dmp

Download