Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/08/2026, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
070497d1719f41b97fd15590a67226f47503c21c7202c6e11d9efcd22513ddd4.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
070497d1719f41b97fd15590a67226f47503c21c7202c6e11d9efcd22513ddd4.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 070497d1719f41b97fd15590a67226f47503c21c7202c6e11d9efcd22513ddd4.dll
- Size 60KB
- Sample260811-e6acdawbme
- SHA256 070497d1719f41b97fd15590a67226f47503c21c7202c6e11d9efcd22513ddd4
- MD5 3077023449acf4f61f83c23cd4a4d66d
- SHA1 40f358ed2ed4ee6a2a56058c273cdd137584d40e
- SHA512 be9a9ef4e9def998fb62a1317adb5552bf26478ef26539b50ef4a4f599743c702ef5c9c826f9811ec1263c97ac52304b53327c0117c803f55a2dd38995f7505f
- SSDEEP 1536:DnA0/frll7HPL9TSRYcprvccu6IxCDcEQ1GiImC9i/Oo2aF:D6y0I
- TLSH T19853D527B5F6D03AD98501B40E17D7FE092D3E531F06DA2B3684F78E4B32994612A92F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\ = "_clsMVT_Moment_Gamma" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_MVT_M.clsMVT_Moment_Xi\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EA99AB9-7816-4865-BCCE-FED281506313}\1d.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\070497d1719f41b97fd15590a67226f47503c21c7202c6e11d9efcd22513ddd4.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E4144D1-82A4-4B05-B914-6B975BD350EE}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E4144D1-82A4-4B05-B914-6B975BD350EE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\TypeLib\Version = "1d.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_MVT_M.clsMVT_Moment_Gamma\Clsid\ = "{F893ABA0-EC58-49E3-A3C0-31A44150FE40}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E4144D1-82A4-4B05-B914-6B975BD350EE}\TypeLib\Version = "1d.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EA99AB9-7816-4865-BCCE-FED281506313}\1d.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F893ABA0-EC58-49E3-A3C0-31A44150FE40}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F893ABA0-EC58-49E3-A3C0-31A44150FE40}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F893ABA0-EC58-49E3-A3C0-31A44150FE40}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E4144D1-82A4-4B05-B914-6B975BD350EE}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E4144D1-82A4-4B05-B914-6B975BD350EE}\TypeLib\ = "{5EA99AB9-7816-4865-BCCE-FED281506313}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F893ABA0-EC58-49E3-A3C0-31A44150FE40}\ = "MG_MVT_M.clsMVT_Moment_Gamma" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F893ABA0-EC58-49E3-A3C0-31A44150FE40}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F893ABA0-EC58-49E3-A3C0-31A44150FE40}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EA99AB9-7816-4865-BCCE-FED281506313}\1d.0\ = "MorGain MVT_M" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\TypeLib\ = "{5EA99AB9-7816-4865-BCCE-FED281506313}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\TypeLib\ = "{5EA99AB9-7816-4865-BCCE-FED281506313}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F893ABA0-EC58-49E3-A3C0-31A44150FE40} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F893ABA0-EC58-49E3-A3C0-31A44150FE40}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\TypeLib\ = "{5EA99AB9-7816-4865-BCCE-FED281506313}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E4144D1-82A4-4B05-B914-6B975BD350EE}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EA99AB9-7816-4865-BCCE-FED281506313} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F893ABA0-EC58-49E3-A3C0-31A44150FE40}\ProgID\ = "MG_MVT_M.clsMVT_Moment_Gamma" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F893ABA0-EC58-49E3-A3C0-31A44150FE40}\VERSION\ = "29.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_MVT_M.clsMVT_Moment_Gamma regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\ = "clsMVT_Moment_Gamma" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\070497d1719f41b97fd15590a67226f47503c21c7202c6e11d9efcd22513ddd4.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F893ABA0-EC58-49E3-A3C0-31A44150FE40}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EA99AB9-7816-4865-BCCE-FED281506313}\1d.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EA99AB9-7816-4865-BCCE-FED281506313}\1d.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E4144D1-82A4-4B05-B914-6B975BD350EE} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\VERSION\ = "29.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_MVT_M.clsMVT_Moment_Gamma\ = "MG_MVT_M.clsMVT_Moment_Gamma" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_MVT_M.clsMVT_Moment_Gamma\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E4144D1-82A4-4B05-B914-6B975BD350EE}\ = "clsMVT_Moment_Xi" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E4144D1-82A4-4B05-B914-6B975BD350EE}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\TypeLib\Version = "1d.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F893ABA0-EC58-49E3-A3C0-31A44150FE40}\TypeLib\ = "{5EA99AB9-7816-4865-BCCE-FED281506313}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\ = "MG_MVT_M.clsMVT_Moment_Xi" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E320202D-BA7C-4CBB-B9D4-4DCAEE1207D4}\ProgID\ = "MG_MVT_M.clsMVT_Moment_Xi" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E4144D1-82A4-4B05-B914-6B975BD350EE}\ = "_clsMVT_Moment_Xi" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5EA99AB9-7816-4865-BCCE-FED281506313}\1d.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E4144D1-82A4-4B05-B914-6B975BD350EE}\ = "_clsMVT_Moment_Xi" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2E4144D1-82A4-4B05-B914-6B975BD350EE}\TypeLib\ = "{5EA99AB9-7816-4865-BCCE-FED281506313}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3705C5B-B07B-47FA-9B04-A8CE4931D820}\ = "_clsMVT_Moment_Gamma" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 712 wrote to memory of 4140 712 regsvr32.exe 84
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\070497d1719f41b97fd15590a67226f47503c21c7202c6e11d9efcd22513ddd4.dll1⤵
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\070497d1719f41b97fd15590a67226f47503c21c7202c6e11d9efcd22513ddd4.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4140
-