Overview
overview
6Static
static
3Delta V3.56/Delta.exe
windows7-x64
3Delta V3.56/Delta.exe
windows10-2004-x64
6Delta V3.5...it.dll
windows7-x64
1Delta V3.5...it.dll
windows10-2004-x64
1Delta V3.5...on.dll
windows7-x64
1Delta V3.5...on.dll
windows10-2004-x64
1Delta V3.5...87.dll
windows7-x64
1Delta V3.5...87.dll
windows10-2004-x64
3Delta V3.5...PI.dll
windows7-x64
1Delta V3.5...PI.dll
windows10-2004-x64
1Delta V3.5...ua.xml
windows7-x64
1Delta V3.5...ua.xml
windows10-2004-x64
3Analysis
-
max time kernel
126s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2023 21:26
Static task
static1
Behavioral task
behavioral1
Sample
Delta V3.56/Delta.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Delta V3.56/Delta.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Delta V3.56/ICSharpCode.AvalonEdit.dll
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
Delta V3.56/ICSharpCode.AvalonEdit.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Delta V3.56/Newtonsoft.Json.dll
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
Delta V3.56/Newtonsoft.Json.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
Delta V3.56/bin/587.dll
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
Delta V3.56/bin/587.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
Delta V3.56/bin/Fluxteam_net_API.dll
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
Delta V3.56/bin/Fluxteam_net_API.dll
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
Delta V3.56/bin/lua.xml
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
Delta V3.56/bin/lua.xml
Resource
win10v2004-20230703-en
General
-
Target
Delta V3.56/bin/lua.xml
-
Size
3KB
-
MD5
e2b537e027b3251fb82e213739e66376
-
SHA1
e47888a238dcf90097ecd3c8860b0f9b02ded0e3
-
SHA256
5c508701141f851aeb0ad9088759f7da15bc33f9e7459ea8c8d4e1ec7b4eaa60
-
SHA512
1e347301cdc75933d709eddeace7cc9d62a7e9685f5badde3e1ec6f3cdbb37bbb8b95c23632e11b283e0464ab4c84e79c644660a1f0c09f51729e30571555f7e
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2080 3568 WerFault.exe 70
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Delta V3.56\bin\lua.xml"1⤵PID:3568
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3568 -s 4482⤵
- Program crash
PID:2080
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 3568 -ip 35681⤵PID:912