Analysis
- max time kernel
298s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 15:59
Behavioral task
behavioral1
Sample
tempdir.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
tempdir.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
6 signatures
300 seconds
Behavioral task
behavioral3
Sample
tempdir.dll
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
300 seconds
Behavioral task
behavioral4
Sample
tempdir.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
7 signatures
300 seconds
General
- Target tempdir.dll
- Size 8.4MB
- Sample260705-te9eqahs8m
- SHA256 3aea7342a1cf46f6b6cdd9b120831621a848765a2b6d27f192e47c17f5da93cf
- MD5 94dc8225b32c0dad2d7623f956944cae
- SHA1 607af831161b910a3261199dd38335ae8411d2a1
- SHA512 f6fd76c322887324ceea49236060c27676cfb2abb46d278b85d7ec30ac25670ce71c9eb677a3a9521252797d4086c0b827626d398aa4d02adf8236d4b58412d9
- SSDEEP 49152:gVz9KcBToaRdLwHeXOVfFFsP84xE3P+GX4u28VVcnVbyGf5NwnX2kSn4COI9jmTl:45nrwzYPFx4Gq2G6+GMnX2XaDx3
- TLSH T1F89633DE65167208D9192CFDC91A764F34E7BAF3221A1B1887368627231893C6F37E74
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1700 regsvr32.exe -
resource yara_rule behavioral4/memory/1040-0-0x00007FF8B8B80000-0x00007FF8B8FF6000-memory.dmp upx behavioral4/memory/1040-2-0x00007FF8B8B80000-0x00007FF8B8FF6000-memory.dmp upx behavioral4/memory/1040-5-0x00007FF8B8B80000-0x00007FF8B8FF6000-memory.dmp upx - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID regsvr32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName regsvr32.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString regsvr32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe 1040 regsvr32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe Token: SeDebugPrivilege 1040 regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1040 wrote to memory of 1700 1040 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\tempdir.dll1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\ProgramData\DarkSeaGreenChartreuse\regsvr32.exe"C:\ProgramData\DarkSeaGreenChartreuse\regsvr32.exe"2⤵
- Executes dropped EXE
PID:1700
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\DarkSeaGreenChartreuse\regsvr32.exe
- Size 52KB
- SHA256 eab4d04b91b95333d9d8ddeec5efc5fbd96ae1ab6a2d53905df6d3e9674926a2
- MD5 c6fa446ed75472648ab2cc9d391298aa
- SHA1 5f2d2e73c88a183477abbf4fc88d23e388d9092e
- SHA512 ea32d49c982195035894beb77ebfb81e830ff37d3ef08e064ad1596f389a50a1e2237b330205e3e48087503e54d1245a1c1d3e6044a1ff0f11cb16ad1302f7fe
- SSDEEP 384:zIATU0Vid2R57hHZhq78sQ7yvTWp5HZ4XrTZ9FCQl7v9rA9WrHLHW:3TUNQ7Hwwn7yvTWHHyZrC47v9BL
- TLSH T17F33080E67AA34E4E5BA473444731225D771B53127218EFF68E4C17A4F26AE0DA31F4B
- MD5 SHA1 SHA512 SSDEEP TLSH