Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 11:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1accff532dd2f7a53077bfdab38776e921aa2663a7337b448beaa9aa7006e2a3.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1accff532dd2f7a53077bfdab38776e921aa2663a7337b448beaa9aa7006e2a3.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 1accff532dd2f7a53077bfdab38776e921aa2663a7337b448beaa9aa7006e2a3.dll
- Size 88KB
- Sample260730-nz289agh28
- SHA256 1accff532dd2f7a53077bfdab38776e921aa2663a7337b448beaa9aa7006e2a3
- MD5 82f6286d91e36a3230ea321a56b9818c
- SHA1 3e85cda99592ed155e8c25763b21b53ea7be1a45
- SHA512 59f542954a23f4efe0b98a808e0b1b762dd09d2149b8e1b55ccbee150183ada1fcc1f2995a0344e71c53f3e952e7e5f6c1eef413f2aa31ded1d109c9dd70f8e6
- SSDEEP 768:hIlZ+uxGy2Kz8moPmJZ2DsQe7xmAbjz3TS34fAEBLyMhzLLvE8q5NMHoKz3x8vgO:WHE+zgKJ/z3TS34fdBLyuu5CoI3x8
- TLSH T190938E113AD2C8B2D29B0231E8B35B2EB7BE7E314DF10447AF653B5D6D31550DA39606
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9436DCBD-E66D-4CE1-B9D1-549B61CAD7F5}\InprocServer32\ThreadingModel = "both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04C9B51D-52E6-4954-9E51-0404A4CC903F}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04C9B51D-52E6-4954-9E51-0404A4CC903F}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04C9B51D-52E6-4954-9E51-0404A4CC903F}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBClrOverdueShares.ClrOverdueSharescoms.1\CLSID\ = "{9436DCBD-E66D-4CE1-B9D1-549B61CAD7F5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9436DCBD-E66D-4CE1-B9D1-549B61CAD7F5}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1accff532dd2f7a53077bfdab38776e921aa2663a7337b448beaa9aa7006e2a3.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04C9B51D-52E6-4954-9E51-0404A4CC903F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04C9B51D-52E6-4954-9E51-0404A4CC903F}\1.0\ = "KDGBClrOverdueShares 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04C9B51D-52E6-4954-9E51-0404A4CC903F}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1accff532dd2f7a53077bfdab38776e921aa2663a7337b448beaa9aa7006e2a3.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04C9B51D-52E6-4954-9E51-0404A4CC903F}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBClrOverdueShares.ClrOverdueSharescoms.1\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBClrOverdueShares.ClrOverdueSharescoms\ = "ClrOverdueSharescoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9436DCBD-E66D-4CE1-B9D1-549B61CAD7F5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9436DCBD-E66D-4CE1-B9D1-549B61CAD7F5}\ = "ClrOverdueSharescoms Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9436DCBD-E66D-4CE1-B9D1-549B61CAD7F5}\ProgID\ = "KDGBClrOverdueShares.ClrOverdueSharescoms.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9436DCBD-E66D-4CE1-B9D1-549B61CAD7F5}\VersionIndependentProgID\ = "KDGBClrOverdueShares.ClrOverdueSharescoms" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04C9B51D-52E6-4954-9E51-0404A4CC903F}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBClrOverdueShares.ClrOverdueSharescoms.1\ = "ClrOverdueSharescoms Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBClrOverdueShares.ClrOverdueSharescoms regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBClrOverdueShares.ClrOverdueSharescoms\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBClrOverdueShares.ClrOverdueSharescoms\CLSID\ = "{9436DCBD-E66D-4CE1-B9D1-549B61CAD7F5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9436DCBD-E66D-4CE1-B9D1-549B61CAD7F5}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9436DCBD-E66D-4CE1-B9D1-549B61CAD7F5}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04C9B51D-52E6-4954-9E51-0404A4CC903F}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{04C9B51D-52E6-4954-9E51-0404A4CC903F}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KDGBClrOverdueShares.ClrOverdueSharescoms.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9436DCBD-E66D-4CE1-B9D1-549B61CAD7F5}\VersionIndependentProgID regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 992 wrote to memory of 2948 992 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\1accff532dd2f7a53077bfdab38776e921aa2663a7337b448beaa9aa7006e2a3.dll1⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\1accff532dd2f7a53077bfdab38776e921aa2663a7337b448beaa9aa7006e2a3.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2948
-