58ac2f65e335922be3f60e57099dc8a3
Hash
- MD5: 58ac2f65e335922be3f60e57099dc8a3
- SHA1: 415cd98b9353b098382bb1d38dd57a10b9db208e
- SHA256: 2d597c3a726970927b302bf015cec4e37cdc974959cb846dbcb23cdb46386a6c
- First Seen: 2026-05-14
- Last Seen: 2026-05-14
-
1
Related Reports
-
0
Related IOCs
Additional Information
VirusTotal
{
"data": {
"id": "2d597c3a726970927b302bf015cec4e37cdc974959cb846dbcb23cdb46386a6c",
"type": "file",
"links": {
"self": "https://www.virustotal.com/api/v3/files/2d597c3a726970927b302bf015cec4e37cdc974959cb846dbcb23cdb46386a6c"
},
"attributes": {
"type_tag": "pedll",
"creation_date": 1768288817,
"last_modification_date": 1779921088,
"type_description": "Win32 DLL",
"popular_threat_classification": {
"suggested_threat_label": "trojan.kimsuky/tedy",
"popular_threat_name": [
{
"count": 15,
"value": "kimsuky"
},
{
"count": 6,
"value": "tedy"
},
{
"count": 2,
"value": "vsntaf26"
}
],
"popular_threat_category": [
{
"count": 25,
"value": "trojan"
}
]
},
"authentihash": "6ebf72026d9e63b22afa4705f7ba4d6f2cfe0c68826e92b32518167732f36060",
"first_seen_itw_date": 1768385455,
"last_analysis_stats": {
"malicious": 51,
"suspicious": 0,
"undetected": 20,
"harmless": 0,
"timeout": 0,
"confirmed-timeout": 0,
"failure": 0,
"type-unsupported": 4
},
"last_analysis_results": {
"Bkav": {
"method": "blacklist",
"engine_name": "Bkav",
"engine_version": "8.2.40(8338)",
"engine_update": "20260527",
"category": "malicious",
"result": "W32.Malware.C1AD2F7E"
},
"Lionic": {
"method": "blacklist",
"engine_name": "Lionic",
"engine_version": "8.16",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan.Win32.Kimsuky.4!c"
},
"tehtris": {
"method": "blacklist",
"engine_name": "tehtris",
"engine_version": "v0.1.4",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"ClamAV": {
"method": "blacklist",
"engine_name": "ClamAV",
"engine_version": "1.5.2.0",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"CMC": {
"method": "blacklist",
"engine_name": "CMC",
"engine_version": "2.4.2022.1",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"CAT-QuickHeal": {
"method": "blacklist",
"engine_name": "CAT-QuickHeal",
"engine_version": "22.00",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"Skyhigh": {
"method": "blacklist",
"engine_name": "Skyhigh",
"engine_version": "v2021.2.0+4045",
"engine_update": "20260527",
"category": "malicious",
"result": "BehavesLike.Win64.NetLoader.dh"
},
"ALYac": {
"method": "blacklist",
"engine_name": "ALYac",
"engine_version": "2.0.0.10",
"engine_update": "20260527",
"category": "malicious",
"result": "Backdoor.Agent.status"
},
"Cylance": {
"method": "blacklist",
"engine_name": "Cylance",
"engine_version": "3.0.0.0",
"engine_update": "20260521",
"category": "malicious",
"result": "Unsafe"
},
"VIPRE": {
"method": "blacklist",
"engine_name": "VIPRE",
"engine_version": "6.0.0.35",
"engine_update": "20260527",
"category": "malicious",
"result": "Gen:Variant.Application.Tedy.51858"
},
"Sangfor": {
"method": "blacklist",
"engine_name": "Sangfor",
"engine_version": "2.22.3.0",
"engine_update": "20260525",
"category": "malicious",
"result": "Suspicious.Win32.Save.a"
},
"K7AntiVirus": {
"method": "blacklist",
"engine_name": "K7AntiVirus",
"engine_version": "14.54.59634",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan ( 006d8c7e1 )"
},
"BitDefender": {
"method": "blacklist",
"engine_name": "BitDefender",
"engine_version": "7.2",
"engine_update": "20260527",
"category": "malicious",
"result": "Gen:Variant.Application.Tedy.51858"
},
"K7GW": {
"method": "blacklist",
"engine_name": "K7GW",
"engine_version": "14.54.59634",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan ( 006d8c7e1 )"
},
"CrowdStrike": {
"method": "blacklist",
"engine_name": "CrowdStrike",
"engine_version": "1.0",
"engine_update": "20251219",
"category": "malicious",
"result": "win/malicious_confidence_100% (W)"
},
"Arcabit": {
"method": "blacklist",
"engine_name": "Arcabit",
"engine_version": "2025.0.0.23",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan.Application.Tedy.DCA92"
},
"huorong": {
"method": "blacklist",
"engine_name": "huorong",
"engine_version": "8019ebe:8019ebe:4ac772e:4ac772e",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"VirIT": {
"method": "blacklist",
"engine_name": "VirIT",
"engine_version": "9.5.1216",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"Symantec": {
"method": "blacklist",
"engine_name": "Symantec",
"engine_version": "1.22.0.0",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan Horse"
},
"Elastic": {
"method": "blacklist",
"engine_name": "Elastic",
"engine_version": "4.0.264",
"engine_update": "20260527",
"category": "malicious",
"result": "malicious (high confidence)"
},
"ESET-NOD32": {
"method": "blacklist",
"engine_name": "ESET-NOD32",
"engine_version": "18.2.18.0",
"engine_update": "20260527",
"category": "malicious",
"result": "Win64/Kimsuky.BL trojan"
},
"APEX": {
"method": "blacklist",
"engine_name": "APEX",
"engine_version": "6.782",
"engine_update": "20260525",
"category": "malicious",
"result": "Malicious"
},
"TrendMicro-HouseCall": {
"method": "blacklist",
"engine_name": "TrendMicro-HouseCall",
"engine_version": "24.550.0.1002",
"engine_update": "20260527",
"category": "malicious",
"result": "TROJ_FRS.VSNTAF26"
},
"Paloalto": {
"method": "blacklist",
"engine_name": "Paloalto",
"engine_version": "0.9.0.1003",
"engine_update": "20260527",
"category": "malicious",
"result": "generic.ml"
},
"Cynet": {
"method": "blacklist",
"engine_name": "Cynet",
"engine_version": "4.0.3.4",
"engine_update": "20260527",
"category": "malicious",
"result": "Malicious (score: 100)"
},
"Kaspersky": {
"method": "blacklist",
"engine_name": "Kaspersky",
"engine_version": "22.0.1.28",
"engine_update": "20260527",
"category": "malicious",
"result": "HEUR:Trojan.Win64.Kimsuky.gen"
},
"Alibaba": {
"method": "blacklist",
"engine_name": "Alibaba",
"engine_version": "0.3.0.5",
"engine_update": "20190527",
"category": "malicious",
"result": "Trojan:Win64/Kimsuky.54e464f9"
},
"NANO-Antivirus": {
"method": "blacklist",
"engine_name": "NANO-Antivirus",
"engine_version": "1.0.170.26895",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"SUPERAntiSpyware": {
"method": "blacklist",
"engine_name": "SUPERAntiSpyware",
"engine_version": "5.6.0.1032",
"engine_update": "20260525",
"category": "undetected",
"result": null
},
"MicroWorld-eScan": {
"method": "blacklist",
"engine_name": "MicroWorld-eScan",
"engine_version": "14.0.409.0",
"engine_update": "20260527",
"category": "malicious",
"result": "Gen:Variant.Application.Tedy.51858"
},
"Tencent": {
"method": "blacklist",
"engine_name": "Tencent",
"engine_version": "1.0.0.1",
"engine_update": "20260527",
"category": "malicious",
"result": "Malware.Win32.Gencirc.14a75b6a"
},
"Sophos": {
"method": "blacklist",
"engine_name": "Sophos",
"engine_version": "3.5.1.0",
"engine_update": "20260527",
"category": "malicious",
"result": "Mal/Generic-S"
},
"F-Secure": {
"method": "blacklist",
"engine_name": "F-Secure",
"engine_version": "18.10.1547.307",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan.TR/W32.Kimsuky.AX"
},
"DrWeb": {
"method": "blacklist",
"engine_name": "DrWeb",
"engine_version": "7.0.75.2070",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan.Siggen32.18720"
},
"Zillya": {
"method": "blacklist",
"engine_name": "Zillya",
"engine_version": "2.0.0.5608",
"engine_update": "20260525",
"category": "malicious",
"result": "Trojan.Kimsuky.Win64.122"
},
"TrendMicro": {
"method": "blacklist",
"engine_name": "TrendMicro",
"engine_version": "24.550.0.1002",
"engine_update": "20260527",
"category": "malicious",
"result": "TROJ_FRS.VSNTAF26"
},
"McAfeeD": {
"method": "blacklist",
"engine_name": "McAfeeD",
"engine_version": "1.2.0.14532",
"engine_update": "20260527",
"category": "malicious",
"result": "ti!2D597C3A7269"
},
"Trapmine": {
"method": "blacklist",
"engine_name": "Trapmine",
"engine_version": "4.0.12.0",
"engine_update": "20260504",
"category": "undetected",
"result": null
},
"CTX": {
"method": "blacklist",
"engine_name": "CTX",
"engine_version": "2024.8.29.1",
"engine_update": "20260527",
"category": "malicious",
"result": "dll.trojan.kimsuky"
},
"Emsisoft": {
"method": "blacklist",
"engine_name": "Emsisoft",
"engine_version": "2024.8.0.61147",
"engine_update": "20260527",
"category": "malicious",
"result": "Gen:Variant.Application.Tedy.51858 (B)"
},
"Ikarus": {
"method": "blacklist",
"engine_name": "Ikarus",
"engine_version": "6.4.16.0",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan.Win64.Kimsuky"
},
"Jiangmin": {
"method": "blacklist",
"engine_name": "Jiangmin",
"engine_version": "16.0.100",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"Webroot": {
"method": "blacklist",
"engine_name": "Webroot",
"engine_version": "1.9.0.8",
"engine_update": "20250227",
"category": "undetected",
"result": null
},
"Google": {
"method": "blacklist",
"engine_name": "Google",
"engine_version": "1779890474",
"engine_update": "20260527",
"category": "malicious",
"result": "Detected"
},
"Avira": {
"method": "blacklist",
"engine_name": "Avira",
"engine_version": "8.3.3.24",
"engine_update": "20260527",
"category": "malicious",
"result": "TR/W32.Kimsuky.AX"
},
"Antiy-AVL": {
"method": "blacklist",
"engine_name": "Antiy-AVL",
"engine_version": "3.0",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan/Win64.Kimsuky"
},
"Kingsoft": {
"method": "blacklist",
"engine_name": "Kingsoft",
"engine_version": "None",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"Gridinsoft": {
"method": "blacklist",
"engine_name": "Gridinsoft",
"engine_version": "1.0.246.174",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan.Win64.Agent.oa!s1"
},
"Xcitium": {
"method": "blacklist",
"engine_name": "Xcitium",
"engine_version": "38681",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"Microsoft": {
"method": "blacklist",
"engine_name": "Microsoft",
"engine_version": "1.1.26040.8",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"ViRobot": {
"method": "blacklist",
"engine_name": "ViRobot",
"engine_version": "2014.3.20.0",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan.Win.S.Agent.251904.A"
},
"ZoneAlarm": {
"method": "blacklist",
"engine_name": "ZoneAlarm",
"engine_version": "6.25-116107068",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"GData": {
"method": "blacklist",
"engine_name": "GData",
"engine_version": "GD:27.44694AVA:64.31315",
"engine_update": "20260527",
"category": "malicious",
"result": "Gen:Variant.Application.Tedy.51858"
},
"Varist": {
"method": "blacklist",
"engine_name": "Varist",
"engine_version": "6.6.1.3",
"engine_update": "20260527",
"category": "malicious",
"result": "W64/ABTrojan.WAHW-8873"
},
"AhnLab-V3": {
"method": "blacklist",
"engine_name": "AhnLab-V3",
"engine_version": "3.30.0.10666",
"engine_update": "20260527",
"category": "malicious",
"result": "Backdoor/Win.Agent.R756137"
},
"Acronis": {
"method": "blacklist",
"engine_name": "Acronis",
"engine_version": "1.2.0.121",
"engine_update": "20240328",
"category": "undetected",
"result": null
},
"VBA32": {
"method": "blacklist",
"engine_name": "VBA32",
"engine_version": "5.6.1",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"TACHYON": {
"method": "blacklist",
"engine_name": "TACHYON",
"engine_version": "2026-05-27.02",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan/W64.Agent.251904.E"
},
"DeepInstinct": {
"method": "blacklist",
"engine_name": "DeepInstinct",
"engine_version": "5.0.0.8",
"engine_update": "20260527",
"category": "malicious",
"result": "MALICIOUS"
},
"Malwarebytes": {
"method": "blacklist",
"engine_name": "Malwarebytes",
"engine_version": "3.1.0.235",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan.MalPack"
},
"Panda": {
"method": "blacklist",
"engine_name": "Panda",
"engine_version": "4.6.4.2",
"engine_update": "20260526",
"category": "undetected",
"result": null
},
"Zoner": {
"method": "blacklist",
"engine_name": "Zoner",
"engine_version": "2.2.2.0",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"Rising": {
"method": "blacklist",
"engine_name": "Rising",
"engine_version": "25.0.0.28",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan.[Kimsuky]MemLoader!1.13F04 (CLASSIC)"
},
"Yandex": {
"method": "blacklist",
"engine_name": "Yandex",
"engine_version": "5.5.2.24",
"engine_update": "20260527",
"category": "undetected",
"result": null
},
"TrellixENS": {
"method": "blacklist",
"engine_name": "TrellixENS",
"engine_version": "6.0.6.653",
"engine_update": "20260527",
"category": "malicious",
"result": "Artemis!58AC2F65E335"
},
"SentinelOne": {
"method": "blacklist",
"engine_name": "SentinelOne",
"engine_version": "7.6.2.19",
"engine_update": "20260324",
"category": "malicious",
"result": "Static AI - Suspicious PE"
},
"MaxSecure": {
"method": "blacklist",
"engine_name": "MaxSecure",
"engine_version": "1.0.0.1",
"engine_update": "20260527",
"category": "malicious",
"result": "Trojan.Malware.582394658.susgen"
},
"Fortinet": {
"method": "blacklist",
"engine_name": "Fortinet",
"engine_version": "7.0.48.0",
"engine_update": "20260527",
"category": "malicious",
"result": "W64/Kimsuky.BL!tr"
},
"AVG": {
"method": "blacklist",
"engine_name": "AVG",
"engine_version": "23.9.8494.0",
"engine_update": "20260527",
"category": "malicious",
"result": "Win32:Kimsuky-AX [Trj]"
},
"Avast": {
"method": "blacklist",
"engine_name": "Avast",
"engine_version": "23.9.8494.0",
"engine_update": "20260527",
"category": "malicious",
"result": "Win32:Kimsuky-AX [Trj]"
},
"alibabacloud": {
"method": "blacklist",
"engine_name": "alibabacloud",
"engine_version": "2.2.0",
"engine_update": "20250321",
"category": "malicious",
"result": "Trojan:Win/Kimsuky.BE"
},
"Trustlook": {
"method": "blacklist",
"engine_name": "Trustlook",
"engine_version": "1.0",
"engine_update": "20260527",
"category": "type-unsupported",
"result": null
},
"SymantecMobileInsight": {
"method": "blacklist",
"engine_name": "SymantecMobileInsight",
"engine_version": "2.0",
"engine_update": "20260123",
"category": "type-unsupported",
"result": null
},
"BitDefenderFalx": {
"method": "blacklist",
"engine_name": "BitDefenderFalx",
"engine_version": "2.0.936",
"engine_update": "20260525",
"category": "type-unsupported",
"result": null
},
"Avast-Mobile": {
"method": "blacklist",
"engine_name": "Avast-Mobile",
"engine_version": "260527-02",
"engine_update": "20260527",
"category": "type-unsupported",
"result": null
}
},
"tlsh": "T1C4347C1577A40CB9E877823CC8574A0AE7F2BC160761EADF03A0426B9F2B7D1953E761",
"unique_sources": 1,
"times_submitted": 1,
"total_votes": {
"harmless": 0,
"malicious": 1
},
"first_submission_date": 1768357098,
"magic": "PE32+ executable (DLL) (GUI) x86-64, for MS Windows",
"filecondis": {
"dhash": "787c3c3c1e2d0800",
"raw_md5": "5e6ea29a054f0fdb8111bc3e74e5791e"
},
"reputation": -52,
"magika": "PEBIN",
"meaningful_name": "ltmzcvh.vdvw",
"ssdeep": "3072:lTHKaabqGf95AjPWX8i+Pk6+JymGdV0qxo8m0sGuMzVwgY3qsywpYUzKlhzSpmrk:lTa5aWX8i8kFomG30qHsYzVYV4rY",
"detectiteasy": {
"filetype": "PE64",
"values": [
{
"info": "LTCG/C++",
"version": "19.36.33523",
"type": "Compiler",
"name": "Microsoft Visual C/C++"
},
{
"version": "14.36.33523",
"type": "Linker",
"name": "Microsoft Linker"
},
{
"version": "2022 version 17.6",
"type": "Tool",
"name": "Visual Studio"
}
]
},
"trid": [
{
"file_type": "Win64 Executable (generic)",
"probability": 37.0
},
{
"file_type": "Win16 NE executable (generic)",
"probability": 28.6
},
{
"file_type": "OS/2 Executable (generic)",
"probability": 11.5
},
{
"file_type": "Generic Win/DOS Executable",
"probability": 11.3
},
{
"file_type": "DOS Executable (generic)",
"probability": 11.3
}
],
"last_submission_date": 1768357098,
"sandbox_verdicts": {
"Dr.Web vxCube": {
"category": "malicious",
"malware_classification": [
"MALWARE"
],
"sandbox_name": "Dr.Web vxCube"
},
"C2AE": {
"category": "undetected",
"malware_classification": [
"UNKNOWN_VERDICT"
],
"sandbox_name": "C2AE"
}
},
"size": 251904,
"last_analysis_date": 1779895080,
"names": [
"ltmzcvh.vdvw",
"lTmZcvH.vdVW",
"97fjimrq.exe"
],
"sigma_analysis_results": [
{
"rule_level": "high",
"rule_id": "f4143907bd6e32636e7bc2f3b4f1fca7dde5ff6787f10a17b360a798f52c6357",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Uncommon Svchost Command Line Parameter",
"rule_description": "Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.\nThis could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.\n",
"rule_author": "Liran Ravich",
"match_context": [
{
"values": {
"CommandLine": "%WINDIR%\\system32\\svchost.exe",
"Image": "C:\\Windows\\system32\\svchost.exe",
"EventID": "1"
}
}
]
},
{
"rule_level": "medium",
"rule_id": "047ea96432123c5b2a32816291dc196702b51bd9d49adb2c1673b59dd0018a0c",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "DNS Query Request By Regsvr32.EXE",
"rule_description": "Detects DNS queries initiated by \"Regsvr32.exe\"",
"rule_author": "Dmitriy Lifanov, oscd.community",
"match_context": [
{
"values": {
"QueryResults": "::ffff:192.64.83.138;",
"QueryStatus": "0",
"QueryName": "load.ssangyongcne.o-r.kr",
"Image": "C:\\Windows\\system32\\regsvr32.exe",
"EventID": "22"
}
},
{
"values": {
"QueryResults": "::ffff:192.64.83.138;",
"QueryStatus": "0",
"QueryName": "load.ssangyongcne.o-r.kr",
"Image": "C:\\Windows\\System32\\regsvr32.exe",
"EventID": "22"
}
}
]
},
{
"rule_level": "medium",
"rule_id": "c0cdd12b4805f2aebecbc0415332f2594acf1ae6d8d82da086eeac9a84bf0c37",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Regsvr32 DLL Execution With Uncommon Extension",
"rule_description": "Detects a \"regsvr32\" execution where the DLL doesn't contain a common file extension.",
"rule_author": "Florian Roth (Nextron Systems)",
"match_context": [
{
"values": {
"CommandLine": "%WINDIR%\\system32\\regsvr32.exe",
"Image": "C:\\Windows\\system32\\regsvr32.exe",
"EventID": "1"
}
}
]
},
{
"rule_level": "medium",
"rule_id": "dc313eb40a68f81f4e6cc8b4658215600b2bac992cb67ea873d40ba70e41b7b3",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Network Connection Initiated By Regsvr32.EXE",
"rule_description": "Detects a network connection initiated by \"Regsvr32.exe\"",
"rule_author": "Dmitriy Lifanov, oscd.community",
"match_context": [
{
"values": {
"SourceIsIpv6": "false",
"DestinationPort": "443",
"DestinationIp": "192.64.83.138",
"Protocol": "tcp",
"SourceIp": "192.168.122.105",
"DestinationIsIpv6": "false",
"EventID": "3",
"Image": "C:\\Windows\\system32\\regsvr32.exe",
"SourcePort": "49714",
"Initiated": "true"
}
},
{
"values": {
"SourceIsIpv6": "false",
"DestinationPort": "443",
"Initiated": "true",
"Protocol": "tcp",
"SourceIp": "192.168.122.105",
"DestinationIsIpv6": "false",
"EventID": "3",
"SourcePort": "49719",
"Image": "C:\\Windows\\system32\\regsvr32.exe",
"DestinationIp": "192.64.83.138"
}
},
{
"values": {
"SourceIsIpv6": "false",
"DestinationPort": "443",
"DestinationIp": "192.64.83.138",
"Protocol": "tcp",
"SourceIp": "192.168.122.105",
"DestinationIsIpv6": "false",
"EventID": "3",
"SourcePort": "49720",
"Image": "C:\\Windows\\system32\\regsvr32.exe",
"Initiated": "true"
}
},
{
"values": {
"SourceIsIpv6": "false",
"DestinationPort": "443",
"DestinationIp": "192.64.83.138",
"Protocol": "tcp",
"SourceIp": "192.168.122.105",
"DestinationIsIpv6": "false",
"EventID": "3",
"Image": "C:\\Windows\\system32\\regsvr32.exe",
"SourcePort": "49721",
"Initiated": "true"
}
},
{
"values": {
"SourceIsIpv6": "false",
"DestinationPort": "443",
"Initiated": "true",
"Protocol": "tcp",
"SourceIp": "192.168.122.105",
"DestinationIsIpv6": "false",
"EventID": "3",
"SourcePort": "49722",
"Image": "C:\\Windows\\system32\\regsvr32.exe",
"DestinationIp": "192.64.83.138"
}
}
]
},
{
"rule_level": "medium",
"rule_id": "e13498937de9343f50c1e8f315ce602aa238e37e21f3dbb15d3403c25afafe3e",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Files With System Process Name In Unsuspected Locations",
"rule_description": "Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.).\nIt is highly recommended to perform an initial baseline before using this rule in production.\n",
"rule_author": "Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)",
"match_context": [
{
"values": {
"TargetFilename": "%windir%\\System32\\regsvr32.exe"
}
}
]
},
{
"rule_level": "low",
"rule_id": "1c2e4db94ca79f939e94e29c04fb3b71467fc6f5b9c31db34fcce5a2fb3b856f",
"rule_source": "Sigma Integrated Rule Set (GitHub)",
"rule_title": "Non Interactive PowerShell Process Spawned",
"rule_description": "Detects non-interactive PowerShell activity by looking at the \"powershell\" process with a non-user GUI process such as \"explorer.exe\" as a parent.",
"rule_author": "Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)",
"match_context": [
{
"values": {
"CommandLine": "%WINDIR%\\system32\\windowspowershell\\v1.0\\powershell.exe",
"Image": "C:\\Windows\\system32\\windowspowershell\\v1.0\\powershell.exe",
"EventID": "1"
}
}
]
}
],
"type_extension": "dll",
"md5": "58ac2f65e335922be3f60e57099dc8a3",
"sha256": "2d597c3a726970927b302bf015cec4e37cdc974959cb846dbcb23cdb46386a6c",
"vhash": "125076655d155515155048z5b3z31z304fz2az1",
"sha1": "415cd98b9353b098382bb1d38dd57a10b9db208e",
"sigma_analysis_stats": {
"critical": 0,
"high": 1,
"medium": 4,
"low": 1
},
"sigma_analysis_summary": {
"Sigma Integrated Rule Set (GitHub)": {
"critical": 0,
"high": 1,
"medium": 4,
"low": 1
}
},
"type_tags": [
"executable",
"windows",
"win32",
"pe",
"pedll"
],
"tags": [
"long-sleeps",
"pedll",
"64bits",
"detect-debug-environment"
],
"pe_info": {
"timestamp": 1768288817,
"imphash": "c22e6504646ea6a864cebf41f3a3e80e",
"machine_type": 34404,
"entry_point": 44084,
"resource_details": [
{
"lang": "ENGLISH US",
"chi2": 1428.08,
"filetype": "XML",
"entropy": 4.885799884796143,
"sha256": "d2952e57023848a37fb0f21f0dfb38c9000f610ac2b00c2f128511dfd68bde04",
"type": "RT_MANIFEST"
}
],
"resource_langs": {
"ENGLISH US": 1
},
"resource_types": {
"RT_MANIFEST": 1
},
"sections": [
{
"name": ".text",
"chi2": 982115.75,
"virtual_address": 4096,
"flags": "rx",
"raw_size": 164352,
"entropy": 6.48,
"virtual_size": 163892,
"md5": "918abaa2c41cd473f11cd9314d40fa0c"
},
{
"name": ".rdata",
"chi2": 3688454.5,
"virtual_address": 172032,
"flags": "r",
"raw_size": 68608,
"entropy": 4.85,
"virtual_size": 68520,
"md5": "3e7dff8899ce44fd64d2d2e783b7c263"
},
{
"name": ".data",
"chi2": 537461.75,
"virtual_address": 241664,
"flags": "rw",
"raw_size": 5120,
"entropy": 2.96,
"virtual_size": 10716,
"md5": "f90d5cf4da94e29717b3ffb050f1f420"
},
{
"name": ".pdata",
"chi2": 309035.97,
"virtual_address": 253952,
"flags": "r",
"raw_size": 9216,
"entropy": 5.27,
"virtual_size": 8952,
"md5": "c24ccf3ae47cd02e76b93273bc0c9195"
},
{
"name": "_RDATA",
"chi2": 20638.0,
"virtual_address": 266240,
"flags": "r",
"raw_size": 512,
"entropy": 4.11,
"virtual_size": 500,
"md5": "6c0a24279d2031bf67efe2038726e678"
},
{
"name": ".rsrc",
"chi2": 61555.0,
"virtual_address": 270336,
"flags": "r",
"raw_size": 512,
"entropy": 2.52,
"virtual_size": 248,
"md5": "85f1de3d296c3a180123333e0e0edc31"
},
{
"name": ".reloc",
"chi2": 16100.4,
"virtual_address": 274432,
"flags": "r",
"raw_size": 2560,
"entropy": 5.39,
"virtual_size": 2472,
"md5": "9e65d3950340744d4f24fe27effac0ec"
}
],
"exports": [
"DllRegisterServer"
],
"compiler_product_versions": [
"[---] Unmarked objects (old) count=1",
"[ C ] VS2022 v17.9.0 pre 1.0 build 33218 count=14",
"[ASM] VS2022 v17.9.0 pre 1.0 build 33218 count=18",
"[C++] VS2022 v17.9.0 pre 1.0 build 33218 count=79",
"[---] Unmarked objects count=147",
"id: 0x103, version: 30795 count=6",
"id: 0x105, version: 30795 count=171",
"id: 0x104, version: 30795 count=16",
"id: 0x106, version: 30795 count=1",
"id: 0x103, version: 33523 count=2",
"id: 0x101, version: 30795 count=17",
"id: 0x109, version: 33523 count=8",
"id: 0x100, version: 33523 count=1",
"id: 0xff, version: 33523 count=1",
"id: 0x102, version: 33523 count=1"
],
"rich_pe_header_hash": "0c10b108db9e3732557553b6a0b64757",
"import_list": [
{
"library_name": "KERNEL32.dll",
"imported_functions": [
"CloseHandle",
"CreateFileW",
"CreateMutexA",
"CreateThread",
"DecodePointer",
"DeleteCriticalSection",
"EncodePointer",
"EnterCriticalSection",
"EnumSystemFirmwareTables",
"EnumSystemLocalesW",
"ExitProcess",
"FindClose",
"FindFirstFileExW",
"FindNextFileW",
"FlsAlloc",
"FlsFree",
"FlsGetValue",
"FlsSetValue",
"FlushFileBuffers",
"FreeEnvironmentStringsW",
"FreeLibrary",
"GetACP",
"GetCommandLineA",
"GetCommandLineW",
"GetConsoleMode",
"GetConsoleOutputCP",
"GetCPInfo",
"GetCurrentProcess",
"GetCurrentProcessId",
"GetCurrentThreadId",
"GetEnvironmentStringsW",
"GetFileType",
"GetLastError",
"GetLocaleInfoW",
"GetLocalTime",
"GetModuleFileNameW",
"GetModuleHandleExW",
"GetModuleHandleW",
"GetOEMCP",
"GetProcAddress",
"GetProcessHeap",
"GetStartupInfoW",
"GetStdHandle",
"GetStringTypeW",
"GetSystemFirmwareTable",
"GetSystemTimeAsFileTime",
"GetUserDefaultLCID",
"HeapAlloc",
"HeapFree",
"HeapReAlloc",
"HeapSize",
"InitializeCriticalSectionAndSpinCount",
"InitializeCriticalSectionEx",
"InitializeSListHead",
"InterlockedFlushSList",
"IsBadReadPtr",
"IsDebuggerPresent",
"IsProcessorFeaturePresent",
"IsValidCodePage",
"IsValidLocale",
"LCMapStringEx",
"LCMapStringW",
"LeaveCriticalSection",
"LoadLibraryA",
"LoadLibraryExW",
"LocalFree",
"lstrcatW",
"lstrcpyW",
"MultiByteToWideChar",
"QueryPerformanceCounter",
"RaiseException",
"RtlPcToFileHeader",
"RtlUnwindEx",
"SetErrorMode",
"SetFilePointerEx",
"SetLastError",
"SetStdHandle",
"SetUnhandledExceptionFilter",
"Sleep",
"TerminateProcess",
"TlsAlloc",
"TlsFree",
"TlsGetValue",
"TlsSetValue",
"UnhandledExceptionFilter",
"VirtualAlloc",
"VirtualFree",
"VirtualProtect",
"WideCharToMultiByte",
"WriteConsoleW",
"WriteFile"
]
},
{
"library_name": "ADVAPI32.dll",
"imported_functions": [
"GetTokenInformation",
"OpenProcessToken",
"RegGetValueW",
"RegOpenKeyExW"
]
},
{
"library_name": "ole32.dll",
"imported_functions": [
"CoCreateInstance",
"CoInitializeEx",
"CoUninitialize"
]
},
{
"library_name": "OLEAUT32.dll",
"imported_functions": [
"SysAllocString",
"SysFreeString",
"VariantClear",
"VariantInit"
]
},
{
"library_name": "WININET.dll",
"imported_functions": [
"InternetCanonicalizeUrlW",
"InternetCrackUrlW"
]
},
{
"library_name": "WINHTTP.dll",
"imported_functions": [
"WinHttpAddRequestHeaders",
"WinHttpCloseHandle",
"WinHttpConnect",
"WinHttpOpen",
"WinHttpOpenRequest",
"WinHttpQueryDataAvailable",
"WinHttpReadData",
"WinHttpReceiveResponse",
"WinHttpSendRequest",
"WinHttpSetOption"
]
},
{
"library_name": "ntdll.dll",
"imported_functions": [
"RtlCaptureContext",
"RtlLookupFunctionEntry",
"RtlVirtualUnwind"
]
}
]
}
}
}
}
Related Reports
2026-05-14
Kaspersky