Analysis
- max time kernel
148s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 12:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
39c2c91e4af7109805846f45d93baadc1d8897f18caf70ef96c037b469d7b9aa.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
39c2c91e4af7109805846f45d93baadc1d8897f18caf70ef96c037b469d7b9aa.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 39c2c91e4af7109805846f45d93baadc1d8897f18caf70ef96c037b469d7b9aa.dll
- Size 104KB
- Sample260730-n86m2aha74
- SHA256 39c2c91e4af7109805846f45d93baadc1d8897f18caf70ef96c037b469d7b9aa
- MD5 567141661d49a16d67bd3d82b7090b89
- SHA1 2c120ffb3eccc1addd2e3811089f670d515933bc
- SHA512 ca5fadf077df808dbc7c8635eddac2e0167a5a7c882d1d6b89788b26067baa763d1df84a5e142de980170651fc2f6ec457f81c71a75df0375a26457d1a5241b0
- SSDEEP 1536:7HVUkI1Wx680QLcyWuWx2GcL2gVWwTR2/Cs3u4iC8DTIps0MaRuFo+RPodsobWr:7HVUkINynd30uzCOTN0MouFoOPodQ
- TLSH T151A39062F2D2C072D0DB863C45259B6DFBBF7E30456448479FA43F8E5E30696A32E606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0B662DF9-1A6C-4E15-AA1C-3AAC9174FFCB}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFreezeCapital.FreezeCapitalcoms.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFreezeCapital.FreezeCapitalcoms.1\ = "FreezeCapitalcoms Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFreezeCapital.FreezeCapitalcoms\ = "FreezeCapitalcoms Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{588D10F1-546C-4604-8DB1-313FC490B542}\ = "FreezeCapitalcoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{588D10F1-546C-4604-8DB1-313FC490B542}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{588D10F1-546C-4604-8DB1-313FC490B542}\ProgID\ = "KDGBFreezeCapital.FreezeCapitalcoms.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0B662DF9-1A6C-4E15-AA1C-3AAC9174FFCB} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0B662DF9-1A6C-4E15-AA1C-3AAC9174FFCB}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFreezeCapital.FreezeCapitalcoms.1\CLSID\ = "{588D10F1-546C-4604-8DB1-313FC490B542}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFreezeCapital.FreezeCapitalcoms regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{588D10F1-546C-4604-8DB1-313FC490B542}\VersionIndependentProgID\ = "KDGBFreezeCapital.FreezeCapitalcoms" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{588D10F1-546C-4604-8DB1-313FC490B542}\InprocServer32\ThreadingModel = "both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0B662DF9-1A6C-4E15-AA1C-3AAC9174FFCB}\1.0\ = "KDGBFreezeCapital 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFreezeCapital.FreezeCapitalcoms\CLSID\ = "{588D10F1-546C-4604-8DB1-313FC490B542}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{588D10F1-546C-4604-8DB1-313FC490B542}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0B662DF9-1A6C-4E15-AA1C-3AAC9174FFCB}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0B662DF9-1A6C-4E15-AA1C-3AAC9174FFCB}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0B662DF9-1A6C-4E15-AA1C-3AAC9174FFCB}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0B662DF9-1A6C-4E15-AA1C-3AAC9174FFCB}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFreezeCapital.FreezeCapitalcoms.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFreezeCapital.FreezeCapitalcoms\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{588D10F1-546C-4604-8DB1-313FC490B542} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{588D10F1-546C-4604-8DB1-313FC490B542}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{588D10F1-546C-4604-8DB1-313FC490B542}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\39c2c91e4af7109805846f45d93baadc1d8897f18caf70ef96c037b469d7b9aa.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0B662DF9-1A6C-4E15-AA1C-3AAC9174FFCB}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0B662DF9-1A6C-4E15-AA1C-3AAC9174FFCB}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\39c2c91e4af7109805846f45d93baadc1d8897f18caf70ef96c037b469d7b9aa.dll" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2536 wrote to memory of 936 2536 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\39c2c91e4af7109805846f45d93baadc1d8897f18caf70ef96c037b469d7b9aa.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\39c2c91e4af7109805846f45d93baadc1d8897f18caf70ef96c037b469d7b9aa.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:936
-