Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
20/10/2026, 22:59
General
- Target tempdir.dll
- Size 10.5MB
- Sample261020-2yctvsys4p
- SHA256 ddd6e694ebfec6022ee6312ada1aca7d75f33d1d44fa6a788f0cefbf9767b585
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\tempdir.dll1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\TomatoMistyRose\regsvr32.exe"C:\ProgramData\TomatoMistyRose\regsvr32.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
regsvr32.exe
memory/4996-0-0x00007FFE42720000-0x00007FFE42E47000-memory.dmp
memory/4996-9-0x00007FFE42720000-0x00007FFE42E47000-memory.dmp