Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ffd86006d7498ca9bf126a614b8cf5a5182b3d27f7a0aa1f4e6fa06fceb1038.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5ffd86006d7498ca9bf126a614b8cf5a5182b3d27f7a0aa1f4e6fa06fceb1038.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 5ffd86006d7498ca9bf126a614b8cf5a5182b3d27f7a0aa1f4e6fa06fceb1038.dll
- Size 112KB
- Sample260730-ntyzmswhkd
- SHA256 5ffd86006d7498ca9bf126a614b8cf5a5182b3d27f7a0aa1f4e6fa06fceb1038
- MD5 2548b62ac19f8c502a9dab743d0e08e4
- SHA1 f2dbd5685b481ea35ad72f237e8f6e08a52a590e
- SHA512 e248e9ba681b894ecbc81c4d1ee9eedbe5c6f43ccda374caf20b49df03397f9f6510f97dc9d5b134b069fe5241e558f8ae7a8aecc8ef4d56dbae256e1e3a1b85
- SSDEEP 3072:66SUxGVUxxwUxGQwUxBUxCwFpR2ELstox87nrpA9oDi:66dYRVf
- TLSH T121B39D0232E58079F58A123E14176B3AD73BBF358F956AC3EB24FB4D5E30690C63A156
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBOtcCheck.OtcCheckcoms regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBOtcCheck.OtcCheckcoms\ = "OtcCheckcoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBOtcCheck.OtcCheckcoms\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{926EE929-F230-48E0-A7DA-029383AD71AC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{926EE929-F230-48E0-A7DA-029383AD71AC}\ = "OtcCheckcoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{926EE929-F230-48E0-A7DA-029383AD71AC}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{926EE929-F230-48E0-A7DA-029383AD71AC}\ProgID\ = "KDGBOtcCheck.OtcCheckcoms.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{926EE929-F230-48E0-A7DA-029383AD71AC}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBOtcCheck.OtcCheckcoms.1\CLSID\ = "{926EE929-F230-48E0-A7DA-029383AD71AC}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBOtcCheck.OtcCheckcoms\CLSID\ = "{926EE929-F230-48E0-A7DA-029383AD71AC}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{926EE929-F230-48E0-A7DA-029383AD71AC}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{926EE929-F230-48E0-A7DA-029383AD71AC}\InprocServer32\ThreadingModel = "both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CD11DD4B-B1F1-4A2F-A001-008AEFC62824}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CD11DD4B-B1F1-4A2F-A001-008AEFC62824}\1.0\ = "KDGBOtcCheck 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CD11DD4B-B1F1-4A2F-A001-008AEFC62824}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CD11DD4B-B1F1-4A2F-A001-008AEFC62824}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{926EE929-F230-48E0-A7DA-029383AD71AC}\VersionIndependentProgID\ = "KDGBOtcCheck.OtcCheckcoms" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CD11DD4B-B1F1-4A2F-A001-008AEFC62824} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CD11DD4B-B1F1-4A2F-A001-008AEFC62824}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CD11DD4B-B1F1-4A2F-A001-008AEFC62824}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CD11DD4B-B1F1-4A2F-A001-008AEFC62824}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CD11DD4B-B1F1-4A2F-A001-008AEFC62824}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBOtcCheck.OtcCheckcoms.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBOtcCheck.OtcCheckcoms.1\ = "OtcCheckcoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBOtcCheck.OtcCheckcoms.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{926EE929-F230-48E0-A7DA-029383AD71AC}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ffd86006d7498ca9bf126a614b8cf5a5182b3d27f7a0aa1f4e6fa06fceb1038.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CD11DD4B-B1F1-4A2F-A001-008AEFC62824}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5ffd86006d7498ca9bf126a614b8cf5a5182b3d27f7a0aa1f4e6fa06fceb1038.dll" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 988 wrote to memory of 1220 988 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5ffd86006d7498ca9bf126a614b8cf5a5182b3d27f7a0aa1f4e6fa06fceb1038.dll1⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5ffd86006d7498ca9bf126a614b8cf5a5182b3d27f7a0aa1f4e6fa06fceb1038.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1220
-