Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 11:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e97584efbb18962bf9b8c89cfc8118f7556ffc544d1f908cf9d343cac2107b45.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
e97584efbb18962bf9b8c89cfc8118f7556ffc544d1f908cf9d343cac2107b45.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target e97584efbb18962bf9b8c89cfc8118f7556ffc544d1f908cf9d343cac2107b45.dll
- Size 352KB
- Sample260730-n1cd8agh32
- SHA256 e97584efbb18962bf9b8c89cfc8118f7556ffc544d1f908cf9d343cac2107b45
- MD5 a63a45812a5857ac10ef9b6fdc0e6d01
- SHA1 e618db692c275a3487a5299082a7da4cc69e7283
- SHA512 8fb83b187cc6f1179bc1e232ff845db83aada7af1ffedc8f8130732205a9f9156616f4795f77f11084a458f5c925eee7f99075259b2cbab0cffe145838459416
- SSDEEP 6144:Sa0WQkeT6SUXCKs8fr277q/I/7gEvhJXc:S/W/eT6SUXCKs8T277qARvPXc
- TLSH T1FF741A10E601C03DF5D500FBAAFE4AEE91986E50974C10D3B7D8F8B6E77A2E27931496
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31FBF087-8085-4DE5-9414-10B8B6A17049}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBETFTranDateSetting.ETFTranDateSettingcoms.1\CLSID\ = "{1327EA77-BE43-4D82-ADFD-C09A0556357E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBETFTranDateSetting.ETFTranDateSettingcoms\CLSID\ = "{1327EA77-BE43-4D82-ADFD-C09A0556357E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1327EA77-BE43-4D82-ADFD-C09A0556357E}\ProgID\ = "KDGBETFTranDateSetting.ETFTranDateSettingcoms.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1327EA77-BE43-4D82-ADFD-C09A0556357E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e97584efbb18962bf9b8c89cfc8118f7556ffc544d1f908cf9d343cac2107b45.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1327EA77-BE43-4D82-ADFD-C09A0556357E}\InprocServer32\ThreadingModel = "both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31FBF087-8085-4DE5-9414-10B8B6A17049} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31FBF087-8085-4DE5-9414-10B8B6A17049}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31FBF087-8085-4DE5-9414-10B8B6A17049}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1327EA77-BE43-4D82-ADFD-C09A0556357E}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBETFTranDateSetting.ETFTranDateSettingcoms.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBETFTranDateSetting.ETFTranDateSettingcoms.1\ = "ETFTranDateSettingcoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBETFTranDateSetting.ETFTranDateSettingcoms\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1327EA77-BE43-4D82-ADFD-C09A0556357E}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31FBF087-8085-4DE5-9414-10B8B6A17049}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31FBF087-8085-4DE5-9414-10B8B6A17049}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1327EA77-BE43-4D82-ADFD-C09A0556357E}\ = "ETFTranDateSettingcoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1327EA77-BE43-4D82-ADFD-C09A0556357E}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31FBF087-8085-4DE5-9414-10B8B6A17049}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31FBF087-8085-4DE5-9414-10B8B6A17049}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e97584efbb18962bf9b8c89cfc8118f7556ffc544d1f908cf9d343cac2107b45.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31FBF087-8085-4DE5-9414-10B8B6A17049}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1327EA77-BE43-4D82-ADFD-C09A0556357E}\VersionIndependentProgID\ = "KDGBETFTranDateSetting.ETFTranDateSettingcoms" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBETFTranDateSetting.ETFTranDateSettingcoms.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBETFTranDateSetting.ETFTranDateSettingcoms regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBETFTranDateSetting.ETFTranDateSettingcoms\ = "ETFTranDateSettingcoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1327EA77-BE43-4D82-ADFD-C09A0556357E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31FBF087-8085-4DE5-9414-10B8B6A17049}\1.0\ = "KDGBETFTranDateSetting 1.0 Type Library" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4588 wrote to memory of 3152 4588 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e97584efbb18962bf9b8c89cfc8118f7556ffc544d1f908cf9d343cac2107b45.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\e97584efbb18962bf9b8c89cfc8118f7556ffc544d1f908cf9d343cac2107b45.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3152
-