Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll
- Size 1.8MB
- Sample260811-e6grfs1xdw
- SHA256 d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b
- MD5 50fe3c36de45def3b76d232d2243bea0
- SHA1 cd8678b2818de1fd3e13c679ca1b569db7a792c2
- SHA512 87dba4f7618cbd8066cf0e22b1dbbcc9d79ff862505e896958400a4b881c40082110976f7d3fd83cee5a2e356b5c813d418e38d4b2c38401ff9ed09b276c7553
- SSDEEP 49152:w8+kk/7zCCr0x+7/wx421/DPwdhDy1O0MmMFBpm:w8+ke7zS+7ox421/Dwdh+1O0MmMFBp
- TLSH T12395A51AF762601DF4C2807C6356B397A5542E361A08C46FF7C09F5C25BDAEBA2B8707
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D97DA3A-E781-4ABE-994C-FF3B0CF34492}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsMaterial\ = "MorGainStrCom.clsMaterial" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEC5EDE-47FE-4D69-88A4-AD3D495AB91F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7F7085F-4B2C-42EA-A623-B6069ED28537}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE735717-E3F6-489A-9F29-8C356DD55A66}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B97572B4-78ED-43E8-96A0-D42F387D94BF}\ = "_clsWind" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D0C794DE-4C87-4667-B819-29C820CDDD12}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C8BA683-FA9E-43AF-981B-3ED631D65589}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A8E7D7E-F6A8-4B04-81C5-500B9A7C236E}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7F7085F-4B2C-42EA-A623-B6069ED28537} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{51805016-91B6-495C-A1ED-0B2B3793EF22}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{51805016-91B6-495C-A1ED-0B2B3793EF22}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsMsMl regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA26A7F1-6985-495E-91E7-F54D8DC7BF2F}\ProgID\ = "MorGainStrCom.clsMaterial" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{470AD1CA-08CF-4B1A-A545-C26E291FEBC4}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE735717-E3F6-489A-9F29-8C356DD55A66}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B97572B4-78ED-43E8-96A0-D42F387D94BF}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{51805016-91B6-495C-A1ED-0B2B3793EF22}\ = "clsBanOld" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C8BA683-FA9E-43AF-981B-3ED631D65589}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F0B80EE-BDDC-4DF4-829C-F31EED17CCED}\TypeLib\Version = "1c.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B97572B4-78ED-43E8-96A0-D42F387D94BF}\TypeLib\ = "{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FAC1ECB3-EEB0-47AE-BE96-618E02A0DB3F}\ = "clsLtBs" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsMoment\Clsid\ = "{BD98BC18-8C0A-4477-AEDA-9788878B011C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F3DAFD2E-21CC-498B-988A-E016A325F81B}\TypeLib\Version = "1c.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{126821A1-F3D7-49BD-A578-E35D09A0E89F}\TypeLib\Version = "1c.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE735717-E3F6-489A-9F29-8C356DD55A66} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FAC1ECB3-EEB0-47AE-BE96-618E02A0DB3F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044B7DC-4CDD-4849-8FB5-CFE79C2A1F48}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{441BF3A3-A33C-4D52-8D3A-E75690C092F4}\ = "MorGainStrCom.clsMVT" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C8BA683-FA9E-43AF-981B-3ED631D65589} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsDlJcOld\ = "MorGainStrCom.clsDlJcOld" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{098DFD26-5F08-4FD3-A977-CD41790B8472}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B97572B4-78ED-43E8-96A0-D42F387D94BF}\TypeLib\Version = "1c.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{441BF3A3-A33C-4D52-8D3A-E75690C092F4}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5A8E7D7E-F6A8-4B04-81C5-500B9A7C236E}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA26A7F1-6985-495E-91E7-F54D8DC7BF2F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEA39F46-B327-4CEB-9B21-0973B0EF3DF4}\ = "MorGainStrCom.clsZhRh" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C8BA683-FA9E-43AF-981B-3ED631D65589}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{698C6BC9-31BF-4B12-9B72-D9BEC5E2285F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05E05D47-3AB5-459D-A226-B34152648E34}\TypeLib\Version = "1c.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{441BF3A3-A33C-4D52-8D3A-E75690C092F4}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{098DFD26-5F08-4FD3-A977-CD41790B8472}\TypeLib\ = "{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D5D1A8A-621D-423A-B592-26DA501FCCAD} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FAC1ECB3-EEB0-47AE-BE96-618E02A0DB3F}\ = "_clsLtBs" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EEA39F46-B327-4CEB-9B21-0973B0EF3DF4}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE735717-E3F6-489A-9F29-8C356DD55A66}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FAC1ECB3-EEB0-47AE-BE96-618E02A0DB3F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D97DA3A-E781-4ABE-994C-FF3B0CF34492}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5C8BA683-FA9E-43AF-981B-3ED631D65589}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA26A7F1-6985-495E-91E7-F54D8DC7BF2F}\ = "MorGainStrCom.clsMaterial" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5}\1c.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{470AD1CA-08CF-4B1A-A545-C26E291FEBC4}\TypeLib\ = "{42AAFBD2-F859-4B39-A612-FE7EDCE3C2B5}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsMVT\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34BFC8E4-1BFD-426C-8605-93E38A3947F9}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MorGainStrCom.clsLfKd\ = "MorGainStrCom.clsLfKd" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{470AD1CA-08CF-4B1A-A545-C26E291FEBC4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7F7085F-4B2C-42EA-A623-B6069ED28537}\ = "_clsLfKd" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC87A68B-DE49-4440-A50A-11AE49989321}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044B7DC-4CDD-4849-8FB5-CFE79C2A1F48}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{126821A1-F3D7-49BD-A578-E35D09A0E89F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{51805016-91B6-495C-A1ED-0B2B3793EF22}\ = "_clsBanOld" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D5D1A8A-621D-423A-B592-26DA501FCCAD}\TypeLib\Version = "1c.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{441BF3A3-A33C-4D52-8D3A-E75690C092F4}\Programmable regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5504 wrote to memory of 1660 5504 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5504 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\d940d9177b529827e9feaaed4c19d7ddea39d117c95844be4aceb0529293d89b.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1660
-