Analysis
- max time kernel
149s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/08/2026, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll
- Size 1.8MB
- Sample260811-e6grfs1xdw
- SHA256 d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b
- MD5 50fe3c36de45def3b76d232d2243bea0
- SHA1 cd8678b2818de1fd3e13c679ca1b569db7a792c2
- SHA512 87dba4f7618cbd8066cf0e22b1dbbcc9d79ff862505e896958400a4b881c40082110976f7d3fd83cee5a2e356b5c813d418e38d4b2c38401ff9ed09b276c7553
- SSDEEP 49152:w8+kk/7zCCr0x+7/wx421/DPwdhDy1O0MmMFBpm:w8+ke7zS+7ox421/Dwdh+1O0MmMFBp
- TLSH T12395A51AF762601DF4C2807C6356B397A5542E361A08C46FF7C09F5C25BDAEBA2B8707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE735717-E3F6-489A-9F29-8C356DD55A66}\TypeLib\ = "{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FAC1ECB3-EEB0-47AE-BE96-618E02A0DB3F}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsBeamPjOld\Clsid\ = "{34BFC8E4-1BFD-426C-8605-93E38A3947F9}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEA39F46-B327-4CEB-9B21-0973B0EF3DF4}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsZhRh\Clsid\ = "{EEA39F46-B327-4CEB-9B21-0973B0EF3DF4}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsLfKd\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D5D1A8A-621D-423A-B592-26DA501FCCAD}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D5D1A8A-621D-423A-B592-26DA501FCCAD}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{698C6BC9-31BF-4B12-9B72-D9BEC5E2285F}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsMaterial\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B97572B4-78ED-43E8-96A0-D42F387D94BF}\TypeLib\ = "{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsMoment\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C8BA683-FA9E-43AF-981B-3ED631D65589}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A8E7D7E-F6A8-4B04-81C5-500B9A7C236E}\VERSION\ = "28.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05E05D47-3AB5-459D-A226-B34152648E34} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FAC1ECB3-EEB0-47AE-BE96-618E02A0DB3F}\ = "_clsLtBs" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B97572B4-78ED-43E8-96A0-D42F387D94BF}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22DB1439-1760-436B-98A2-21B1381DF7E7}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsBanOld regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FAC1ECB3-EEB0-47AE-BE96-618E02A0DB3F}\TypeLib\ = "{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D5D1A8A-621D-423A-B592-26DA501FCCAD}\ = "_clsBeamPjOld" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FAC1ECB3-EEB0-47AE-BE96-618E02A0DB3F}\ = "_clsLtBs" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD98BC18-8C0A-4477-AEDA-9788878B011C}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D5D1A8A-621D-423A-B592-26DA501FCCAD}\ProxyStubClsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsBendComponentBl\Clsid\ = "{5A8E7D7E-F6A8-4B04-81C5-500B9A7C236E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B97572B4-78ED-43E8-96A0-D42F387D94BF}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22DB1439-1760-436B-98A2-21B1381DF7E7}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsLtBs\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0854BA3-DA30-4A13-AED8-7F039CD59F36}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsLtBs regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{05E05D47-3AB5-459D-A226-B34152648E34}\TypeLib\Version = "1c.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0C794DE-4C87-4667-B819-29C820CDDD12}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD98BC18-8C0A-4477-AEDA-9788878B011C}\TypeLib\ = "{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D5D1A8A-621D-423A-B592-26DA501FCCAD}\ = "clsBeamPjOld" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A8E7D7E-F6A8-4B04-81C5-500B9A7C236E}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{698C6BC9-31BF-4B12-9B72-D9BEC5E2285F}\ProgID\ = "MorGainStrCom.clsMsMl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC87A68B-DE49-4440-A50A-11AE49989321}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{51805016-91B6-495C-A1ED-0B2B3793EF22}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34BFC8E4-1BFD-426C-8605-93E38A3947F9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC87A68B-DE49-4440-A50A-11AE49989321}\VERSION regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6173F431-2A52-4CD5-9FB4-98DB28ED4794}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEC5EDE-47FE-4D69-88A4-AD3D495AB91F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEC5EDE-47FE-4D69-88A4-AD3D495AB91F}\TypeLib\ = "{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE735717-E3F6-489A-9F29-8C356DD55A66}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0854BA3-DA30-4A13-AED8-7F039CD59F36}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FAC1ECB3-EEB0-47AE-BE96-618E02A0DB3F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0C794DE-4C87-4667-B819-29C820CDDD12}\ = "MorGainStrCom.clsLtBs" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22DB1439-1760-436B-98A2-21B1381DF7E7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsMVT\ = "MorGainStrCom.clsMVT" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{126821A1-F3D7-49BD-A578-E35D09A0E89F}\ = "_clsMVT" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE735717-E3F6-489A-9F29-8C356DD55A66}\ = "_clsZhRh" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D97DA3A-E781-4ABE-994C-FF3B0CF34492}\VERSION\ = "28.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044B7DC-4CDD-4849-8FB5-CFE79C2A1F48}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A8E7D7E-F6A8-4B04-81C5-500B9A7C236E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F0B80EE-BDDC-4DF4-829C-F31EED17CCED}\TypeLib\ = "{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE735717-E3F6-489A-9F29-8C356DD55A66}\ = "_clsZhRh" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE735717-E3F6-489A-9F29-8C356DD55A66}\TypeLib\ = "{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEA39F46-B327-4CEB-9B21-0973B0EF3DF4}\ProgID\ = "MorGainStrCom.clsZhRh" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A8E7D7E-F6A8-4B04-81C5-500B9A7C236E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5}\1c.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{441BF3A3-A33C-4D52-8D3A-E75690C092F4}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEC5EDE-47FE-4D69-88A4-AD3D495AB91F}\ = "_clsMsMl" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{470AD1CA-08CF-4B1A-A545-C26E291FEBC4}\TypeLib\Version = "1c.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044B7DC-4CDD-4849-8FB5-CFE79C2A1F48}\Programmable regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4832 wrote to memory of 60 4832 regsvr32.exe 86
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:60
-