Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 11:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ecd0a9871611c4364f2d2fb78ea01dd7a11b29451343b23c04a35679619cb38.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ecd0a9871611c4364f2d2fb78ea01dd7a11b29451343b23c04a35679619cb38.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 0ecd0a9871611c4364f2d2fb78ea01dd7a11b29451343b23c04a35679619cb38.dll
- Size 152KB
- Sample260730-nwzzqa1sat
- SHA256 0ecd0a9871611c4364f2d2fb78ea01dd7a11b29451343b23c04a35679619cb38
- MD5 53f9594102ea8a03a76834e90a5a8577
- SHA1 0a6b218a04dcde3a24edb6d8c45bdf0d23c0643e
- SHA512 d73804186227276a4a88ae60ebab4e9b039e11e45aa00916a3c184c8de974980cf36555f9ffcae1acfd886b1a02a88edb5c4bf8d4daf21715c2f15b3c5883c57
- SSDEEP 3072:InI+aLF2vdDru2BAw3WKXPSLA8pl3Tg3uieFbg86Oj926moc6kIb:InI+aLFawb3TzFbMOu2
- TLSH T18CE35B11B3E28099E48F203CA42567BFD77B5D349A5427839BBCFEA82E34550F53D60A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C532B586-C862-4C39-B96D-847647F47A10}\VersionIndependentProgID\ = "KDGBFislBatchSetCustTrade.FislBatchSetCustTradecoms" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18CF6815-A190-49B1-8338-BB54CDC29BE2}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18CF6815-A190-49B1-8338-BB54CDC29BE2}\1.0\ = "KDGBFislBatchSetCustTrade 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18CF6815-A190-49B1-8338-BB54CDC29BE2}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18CF6815-A190-49B1-8338-BB54CDC29BE2}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0ecd0a9871611c4364f2d2fb78ea01dd7a11b29451343b23c04a35679619cb38.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFislBatchSetCustTrade.FislBatchSetCustTradecoms\ = "FislBatchSetCustTradecoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C532B586-C862-4C39-B96D-847647F47A10}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C532B586-C862-4C39-B96D-847647F47A10}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C532B586-C862-4C39-B96D-847647F47A10}\InprocServer32\ThreadingModel = "both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18CF6815-A190-49B1-8338-BB54CDC29BE2}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18CF6815-A190-49B1-8338-BB54CDC29BE2}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18CF6815-A190-49B1-8338-BB54CDC29BE2}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFislBatchSetCustTrade.FislBatchSetCustTradecoms.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFislBatchSetCustTrade.FislBatchSetCustTradecoms.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFislBatchSetCustTrade.FislBatchSetCustTradecoms.1\CLSID\ = "{C532B586-C862-4C39-B96D-847647F47A10}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFislBatchSetCustTrade.FislBatchSetCustTradecoms regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFislBatchSetCustTrade.FislBatchSetCustTradecoms\CLSID\ = "{C532B586-C862-4C39-B96D-847647F47A10}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C532B586-C862-4C39-B96D-847647F47A10}\ = "FislBatchSetCustTradecoms Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C532B586-C862-4C39-B96D-847647F47A10}\ProgID\ = "KDGBFislBatchSetCustTrade.FislBatchSetCustTradecoms.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C532B586-C862-4C39-B96D-847647F47A10}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0ecd0a9871611c4364f2d2fb78ea01dd7a11b29451343b23c04a35679619cb38.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C532B586-C862-4C39-B96D-847647F47A10} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18CF6815-A190-49B1-8338-BB54CDC29BE2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18CF6815-A190-49B1-8338-BB54CDC29BE2}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{18CF6815-A190-49B1-8338-BB54CDC29BE2}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFislBatchSetCustTrade.FislBatchSetCustTradecoms.1\ = "FislBatchSetCustTradecoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBFislBatchSetCustTrade.FislBatchSetCustTradecoms\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C532B586-C862-4C39-B96D-847647F47A10}\VersionIndependentProgID regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5720 wrote to memory of 4840 5720 regsvr32.exe 89
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\0ecd0a9871611c4364f2d2fb78ea01dd7a11b29451343b23c04a35679619cb38.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5720 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\0ecd0a9871611c4364f2d2fb78ea01dd7a11b29451343b23c04a35679619cb38.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4840
-