13be8bd665fb050bdad7b76e5e1e214a676753f0cc2d760a9d1eb7153cdc5049

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 20:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
13be8bd665fb050bdad7b76e5e1e214a676753f0cc2d760a9d1eb7153cdc5049.dll
Size 309KB
Sample260804-y5fmjsdp6s
SHA256 13be8bd665fb050bdad7b76e5e1e214a676753f0cc2d760a9d1eb7153cdc5049
MD5 bdb9854ede7effb2cd803b018b2e66bb
SHA1 aebb154695ef2f7f11312b95ddfa638b0a148cdc
SHA512 4b884df19b0a72418caf305a8fc04a2f77c412800f48da5ef3c504c6fb544c388d4c44b5b0a0cab04a6a6d23032b72f27d61214b95f2018a8b46ffafcb2f42a6
SSDEEP 6144:vlDT/1QOBJhSifVjoIvE92da3QnIkRmotDcifrUpwFXqcjjZAG:v9JQOBJYAVjoHQIvKcifrUId1j
TLSH
T1D664AE927A01883ED92F45724D2E8B79527D63A19BB395C76B4C9CB99F301C01E32F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7086CF95-1215-470E-8032-AA1B540FB5F6}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ XContextMenu	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ XContextMenu\ = "{7086CF95-1215-470E-8032-AA1B540FB5F6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shellex\ContextMenuHandlers\ XContextMenu\ = "{7086CF95-1215-470E-8032-AA1B540FB5F6}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\ XContextMenu	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7086CF95-1215-470E-8032-AA1B540FB5F6}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7086CF95-1215-470E-8032-AA1B540FB5F6}\ = " XContextMenu Handler"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7086CF95-1215-470E-8032-AA1B540FB5F6}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7086CF95-1215-470E-8032-AA1B540FB5F6}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\13be8bd665fb050bdad7b76e5e1e214a676753f0cc2d760a9d1eb7153cdc5049.dll"	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2428	1592	regsvr32.exe	85

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\13be8bd665fb050bdad7b76e5e1e214a676753f0cc2d760a9d1eb7153cdc5049.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\13be8bd665fb050bdad7b76e5e1e214a676753f0cc2d760a9d1eb7153cdc5049.dll
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2428-0-0x000000006EEA0000-0x000000006EEB0000-memory.dmp

Download