Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 04:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5fc9bf32b83776f6b8a9ecc21885b2d8d21e0ee8efa1334b46f3f823945c1b59.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5fc9bf32b83776f6b8a9ecc21885b2d8d21e0ee8efa1334b46f3f823945c1b59.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 5fc9bf32b83776f6b8a9ecc21885b2d8d21e0ee8efa1334b46f3f823945c1b59.dll
- Size 68KB
- Sample260811-e7s6wacd96
- SHA256 5fc9bf32b83776f6b8a9ecc21885b2d8d21e0ee8efa1334b46f3f823945c1b59
- MD5 007c5d0a499c8f118ccf90c40481bc10
- SHA1 2795e761b2176b3c4e0fb5b2f807266805ddb754
- SHA512 d5c06fe06e1a76c8fe1704695abe55ff9ef2982ebc9226ce697acfc59dbcceee9c4fd85130b1ba51063af66c4fe1d4057633f10f111db9246f146320b06b885e
- SSDEEP 768:3MTDzxbyYTpeXrzB2I0OejDYDtt0yc1jeUhSd/ch+QIg4DyqCwzd:3Mz4YTpeX3BnejD4v0h1PhGaHPqBz
- TLSH T18D63F827B2ABD57FD50A00704E5BE3FE14283E560E02D55F6254FB8E0FB2B506526A2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 45 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\ProgID\ = "MG_Material.clsMaterial09" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\TypeLib\ = "{944AF23A-5A9B-43E7-80FD-9736064FEA9C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\VERSION regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\ = "clsMaterial09" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{944AF23A-5A9B-43E7-80FD-9736064FEA9C}\21.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{944AF23A-5A9B-43E7-80FD-9736064FEA9C}\21.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5fc9bf32b83776f6b8a9ecc21885b2d8d21e0ee8efa1334b46f3f823945c1b59.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\ = "MG_Material.clsMaterial09" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\VERSION\ = "33.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Material.clsMaterial09\ = "MG_Material.clsMaterial09" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Material.clsMaterial09\Clsid\ = "{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{944AF23A-5A9B-43E7-80FD-9736064FEA9C}\21.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\TypeLib\ = "{944AF23A-5A9B-43E7-80FD-9736064FEA9C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{944AF23A-5A9B-43E7-80FD-9736064FEA9C}\21.0\ = "MorGain Material" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\TypeLib\Version = "21.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\TypeLib\Version = "21.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5fc9bf32b83776f6b8a9ecc21885b2d8d21e0ee8efa1334b46f3f823945c1b59.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{944AF23A-5A9B-43E7-80FD-9736064FEA9C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{944AF23A-5A9B-43E7-80FD-9736064FEA9C}\21.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{944AF23A-5A9B-43E7-80FD-9736064FEA9C}\21.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\ = "_clsMaterial09" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\ = "_clsMaterial09" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Material.clsMaterial09\Clsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{944AF23A-5A9B-43E7-80FD-9736064FEA9C}\21.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\TypeLib\ = "{944AF23A-5A9B-43E7-80FD-9736064FEA9C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MG_Material.clsMaterial09 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\ProxyStubClsid regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{944AF23A-5A9B-43E7-80FD-9736064FEA9C}\21.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{944AF23A-5A9B-43E7-80FD-9736064FEA9C}\21.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4426834-A065-4DD3-B84B-A492A6264DE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC1A6079-E6C9-4641-A8C1-3A11890DC2B2}\ProgID regsvr32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2560 wrote to memory of 2652 2560 regsvr32.exe 88
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5fc9bf32b83776f6b8a9ecc21885b2d8d21e0ee8efa1334b46f3f823945c1b59.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5fc9bf32b83776f6b8a9ecc21885b2d8d21e0ee8efa1334b46f3f823945c1b59.dll2⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2652
-