skinchanger regent[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
skinchanger regent.dll
Size 148KB
Sample260824-rerhsshk8s
SHA256 92870c7abfd381c0ab88072993c867f0d41ff170761dcd3578fe74a6c4c167ad
MD5 e594e0b6497ba855335c5a6690152e34
SHA1 3e8826be951e31559aa2c83f89fc6745cc48cf92
SHA512 31625b3fb1911259ccaae69208e902509b3f4489c3bd81a7ed900e499ae353907fa7622fd78a25fb8a77e71cbb5973da3ea3e35342332a9d2343efaa5258aa41
SSDEEP 1536:n24/EXdSrFM4bhsVZbSX99ekCG8JblJ28Z720mI9x9eQ/VbQG:nP+qhs7by94k6brg0mI7/Vb
TLSH
T1B7E34B294892133AD0D699B8C8F64907F520BD4507FA9CDF57E008BA6E9A3D0FF1BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
skinchanger regent.dll

File Explorer

skinchanger regent.dll

.dll 148KB

skinchanger regent.dll

IMPHASH 7d2ea6b96b47f8e70239c6ec39a6d765
SHA256 92870c7abfd381c0ab88072993c867f0d41ff170761dcd3578fe74a6c4c167ad
MD5 e594e0b6497ba855335c5a6690152e34
SHA1 3e8826be951e31559aa2c83f89fc6745cc48cf92
SHA512 31625b3fb1911259ccaae69208e902509b3f4489c3bd81a7ed900e499ae353907fa7622fd78a25fb8a77e71cbb5973da3ea3e35342332a9d2343efaa5258aa41
SSDEEP 1536:n24/EXdSrFM4bhsVZbSX99ekCG8JblJ28Z720mI9x9eQ/VbQG:nP+qhs7by94k6brg0mI7/Vb
TLSH
T1B7E34B294892133AD0D699B8C8F64907F520BD4507FA9CDF57E008BA6E9A3D0FF1BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e4:84:af:c5:ff:6d:19:11:a0:9e:c3:6a:e1:79:76:9b:d9:d4:94:27:ae:02:ce:a5:50:f5:33:28:0a:25:27:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN

Chains

Aug 21, 2026

CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=福建六壬网安股份有限公司,OU=IT,O=福建六壬网安股份有限公司,L=福州,ST=福建,C=CN

Serial Number

36:ea:f6:1d:c3:95:f6:30:41:f4:24:7d:ae:76:ab:7e

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 9, 2016 - Aug 12, 2018

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

90508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\mirac\Desktop\ctxbuild\ctx.pdb

kernel32

GetCurrentProcess GetModuleHandleExW VirtualAlloc LeaveCriticalSection InitializeCriticalSection GetCurrentThreadId Sleep GetModuleHandleExA GetTickCount64 DisableThreadLibraryCalls GetCurrentThread CreateThread GetLocalTime GetCurrentProcessId CreateDirectoryA SetUnhandledExceptionFilter GetTickCount VirtualQuery EnterCriticalSection GetModuleFileNameA ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead

user32

GetAsyncKeyState GetSystemMetrics GetCursorPos CallNextHookEx

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z

dbghelp

StackWalk64 SymInitialize SymFunctionTableAccess64 SymGetModuleBase64 SymCleanup SymFromAddr

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __std_exception_destroy __std_exception_copy strrchr __C_specific_handler memcpy memset _CxxThrowException __std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

fopen fflush __stdio_common_vfprintf __stdio_common_vsprintf_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _seh_filter_dll _invoke_watson _initterm_e _initterm _cexit _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

fmaxf powf fmin

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc

api-ms-win-crt-convert-l1-1-0

mbstowcs_s

Sharing

General

Malware Config

Signatures

File Explorer

skinchanger regent.dll

PE Signature issue

kernel32

user32

msvcp140

dbghelp

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic