Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51624a696cc9869e41939be9a87abc059be5f288ffc2429ea9e55eac79612c55.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
51624a696cc9869e41939be9a87abc059be5f288ffc2429ea9e55eac79612c55.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 51624a696cc9869e41939be9a87abc059be5f288ffc2429ea9e55eac79612c55.dll
- Size 1.0MB
- Sample260811-e6ayxawbnc
- SHA256 51624a696cc9869e41939be9a87abc059be5f288ffc2429ea9e55eac79612c55
- MD5 2d5b3c35003aa3873e082138e6eb64a0
- SHA1 0767289e93fb0cb948be1dc86b07c7d023475adc
- SHA512 a22a613f867d01d90233f7cc7f49dab1db4918ee020c00b2b13549323262ed9d09d8ee2ae4ef7d430b409b1d97227b288ab064433122ce272de2e0f7cb4f94f3
- SSDEEP 12288:5zDNTzY2LL4jur5MLVuwIlW3CoiMbvcH8bzq2WtzK5PlFkukxM0KoNjwOjhYMdqn:rzdgwUHWhcC4xf/LNw9wNhN
- TLSH T1FE358356FAB5502DEDC040B42B67A3A365243B33240E846FB7805F8D76317EBA279727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DD5D07A-A272-4F43-B266-1350F4825ACC}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9EB5FE0A-17E7-4AD3-ACB7-823148362DEB}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{398674BF-178A-4D63-8FBE-FBC8C49B439B}\ = "_clsMVT_Moment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4FC603A3-B3DF-4B69-85E0-933E5263EF89}\VERSION\ = "27.2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_MVT.clsDeflection\Clsid\ = "{4FC603A3-B3DF-4B69-85E0-933E5263EF89}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FE5FAEE-131D-493B-9F89-5A0AE630D7D8}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_MVT.clsMVT_Moment regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29558CDA-7941-443C-871E-7BE583DEA0AE}\TypeLib\Version = "1b.2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{398674BF-178A-4D63-8FBE-FBC8C49B439B}\TypeLib\Version = "1b.2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B406D364-0EF3-4ECF-A608-517B3E656CBC}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34566E8A-E55D-4F84-ABA0-5C92BDD84A98}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CAE4F03-905E-46F8-BAF4-58EC59EAAF34}\VERSION\ = "27.2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26827CCB-2681-4A2F-9822-6D5C4378150E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F825F0B-78F0-42DE-BB3C-7E50860B8F4C}\1b.2\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34566E8A-E55D-4F84-ABA0-5C92BDD84A98}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_MVT.clsMVT_Shear_Hw_11\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_MVT.clsMVT_Torsional\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2564D9FF-1982-412C-8B28-EE70F415F9D1}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CDE3E16-74D4-496F-A853-E4BC8F07AAF2}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68ADCFAE-D222-4091-A299-737FA06289DE}\ = "_clsMvtCom" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F825F0B-78F0-42DE-BB3C-7E50860B8F4C}\1b.2\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2AA0A01C-3AA1-4886-975D-EA960AD185CF} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD62AF33-071A-46F1-966C-DCD7DEBB4A04}\ = "clsMVT_Shear_Hw_11" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B406D364-0EF3-4ECF-A608-517B3E656CBC}\ = "clsMVT_Shear_Gamma_11" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{26827CCB-2681-4A2F-9822-6D5C4378150E}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{68ADCFAE-D222-4091-A299-737FA06289DE}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D0F588C-0303-4BC3-8560-0D64B9AB7212}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{61E7F6C9-886D-475D-8ACF-5FC116C9E722}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4FC603A3-B3DF-4B69-85E0-933E5263EF89}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB8644C5-F266-429B-8452-FCFEC5D7C942}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2AA0A01C-3AA1-4886-975D-EA960AD185CF}\ = "_clsMVT_Shear_ShearSpan_11" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2AA0A01C-3AA1-4886-975D-EA960AD185CF}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_MVT.clsDeflection\ = "MG_MVT.clsDeflection" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CAE4F03-905E-46F8-BAF4-58EC59EAAF34}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4FE5FAEE-131D-493B-9F89-5A0AE630D7D8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4FC603A3-B3DF-4B69-85E0-933E5263EF89}\TypeLib\ = "{0F825F0B-78F0-42DE-BB3C-7E50860B8F4C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E457AA35-A484-4C0C-9FBA-6D1DF62A4489}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{61E7F6C9-886D-475D-8ACF-5FC116C9E722} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2564D9FF-1982-412C-8B28-EE70F415F9D1}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{29558CDA-7941-443C-871E-7BE583DEA0AE}\ = "_clsMVT_Moment_Gamma_11" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CDE3E16-74D4-496F-A853-E4BC8F07AAF2}\VERSION\ = "27.2" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CAE4F03-905E-46F8-BAF4-58EC59EAAF34}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DD5D07A-A272-4F43-B266-1350F4825ACC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_MVT.clsMVT_Shear_Gz_11\Clsid\ = "{F3064D1D-4C11-4C6E-97E5-B2F77EC25B18}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{61E7F6C9-886D-475D-8ACF-5FC116C9E722}\TypeLib\ = "{0F825F0B-78F0-42DE-BB3C-7E50860B8F4C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E457AA35-A484-4C0C-9FBA-6D1DF62A4489} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{398674BF-178A-4D63-8FBE-FBC8C49B439B}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CDE3E16-74D4-496F-A853-E4BC8F07AAF2}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D0F588C-0303-4BC3-8560-0D64B9AB7212}\TypeLib\Version = "1b.2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_MVT.clsMVT_Shear_Hw_11\ = "MG_MVT.clsMVT_Shear_Hw_11" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB8644C5-F266-429B-8452-FCFEC5D7C942}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68ADCFAE-D222-4091-A299-737FA06289DE}\ = "_clsMvtCom" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{398674BF-178A-4D63-8FBE-FBC8C49B439B}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2AA0A01C-3AA1-4886-975D-EA960AD185CF}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3064D1D-4C11-4C6E-97E5-B2F77EC25B18}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2564D9FF-1982-412C-8B28-EE70F415F9D1}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1D3A202-AABE-4677-958F-536B3D4148CB}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4FE5FAEE-131D-493B-9F89-5A0AE630D7D8}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27D26439-3062-483A-A650-77053DC7D1C9} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D0F588C-0303-4BC3-8560-0D64B9AB7212}\ = "_clsMVT_Torsional" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1708FD3-6070-4A55-BC89-746C8B4A56D6}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\51624a696cc9869e41939be9a87abc059be5f288ffc2429ea9e55eac79612c55.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3064D1D-4C11-4C6E-97E5-B2F77EC25B18}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD62AF33-071A-46F1-966C-DCD7DEBB4A04}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DD5D07A-A272-4F43-B266-1350F4825ACC}\ = "_clsMVT_Shear_11" regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1740 wrote to memory of 4572 1740 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\51624a696cc9869e41939be9a87abc059be5f288ffc2429ea9e55eac79612c55.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\51624a696cc9869e41939be9a87abc059be5f288ffc2429ea9e55eac79612c55.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4572
-