Analysis
- max time kernel
298s - max time network
184s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/07/2026, 15:59
General
- Target tempdir.dll
- Size 8.4MB
- Sample260705-te9eqahs8m
- SHA256 3aea7342a1cf46f6b6cdd9b120831621a848765a2b6d27f192e47c17f5da93cf
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\tempdir.dll1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\DarkSeaGreenChartreuse\regsvr32.exe"C:\ProgramData\DarkSeaGreenChartreuse\regsvr32.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
regsvr32.exe
memory/1732-0-0x00007FF9EDE90000-0x00007FF9EE306000-memory.dmp
memory/1732-1-0x00007FF9EDE90000-0x00007FF9EE306000-memory.dmp
memory/1732-10-0x00007FF9EDE90000-0x00007FF9EE306000-memory.dmp