Overview
overview
3Static
static
3VwMeter/DeLib.dll
windows7-x64
1VwMeter/DeLib.dll
windows10-2004-x64
1VwMeter/De...st.dll
windows7-x64
1VwMeter/De...st.dll
windows10-2004-x64
1VwMeter/VwMeter.exe
windows7-x64
1VwMeter/VwMeter.exe
windows10-2004-x64
1VwMeter/VwUpdate.exe
windows7-x64
1VwMeter/VwUpdate.exe
windows10-2004-x64
1VwMeter/�...��.url
windows7-x64
1VwMeter/�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
158s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15-03-2024 15:05
Static task
static1
Behavioral task
behavioral1
Sample
VwMeter/DeLib.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
VwMeter/DeLib.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
VwMeter/DeLibSys32test.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
VwMeter/DeLibSys32test.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
VwMeter/VwMeter.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
VwMeter/VwMeter.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
VwMeter/VwUpdate.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
VwMeter/VwUpdate.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
VwMeter/新云软件.url
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
VwMeter/新云软件.url
Resource
win10v2004-20231215-en
General
-
Target
VwMeter/DeLib.dll
-
Size
44KB
-
MD5
3d5efb406effe6f167160610e8e78860
-
SHA1
a0d6378a4554f8703fb3186563f13c4357c745b7
-
SHA256
c6e7fd69ceb18efaad61cde61df76eba9820f9867ae6babc80fd1ee864b6db1f
-
SHA512
870d25487f5a096414458f577aca9d1e8c61f6d1c85c8167def079b9b5a06ef07f9b6dba573eebee88d06797b1cc2f45a46ed3d52e2447452f95bdaeae4eb4ad
-
SSDEEP
384:iPo5WPxmb77ry+D6MQd1WoQtnTazwWKofNPnJobXuJyIobBTz3:ivoHIdsAkh6NPJob+JyIMTz
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 392 wrote to memory of 2012 392 rundll32.exe 86 PID 392 wrote to memory of 2012 392 rundll32.exe 86 PID 392 wrote to memory of 2012 392 rundll32.exe 86
Processes
Network
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request107.211.222.173.in-addr.arpaIN PTRResponse107.211.222.173.in-addr.arpaIN PTRa173-222-211-107deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request76.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request190.178.17.96.in-addr.arpaIN PTRResponse190.178.17.96.in-addr.arpaIN PTRa96-17-178-190deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301465_1IH9IDA0LGHTED0D3&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301465_1IH9IDA0LGHTED0D3&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 286847
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3386473661CE49B8AE92F54DEEBC85F2 Ref B: LON04EDGE0616 Ref C: 2024-03-15T15:07:41Z
date: Fri, 15 Mar 2024 15:07:40 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301032_1O1TBR912QG5BWWX0&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301032_1O1TBR912QG5BWWX0&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 479673
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7F434D4A28CD4C91A05F6A282114A766 Ref B: LON04EDGE0616 Ref C: 2024-03-15T15:07:41Z
date: Fri, 15 Mar 2024 15:07:40 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418592_1RYDTURC2A8KOBZ9U&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239340418592_1RYDTURC2A8KOBZ9U&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 443205
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 962EC847D42A491788BE236A8CB8D1F4 Ref B: LON04EDGE0616 Ref C: 2024-03-15T15:07:41Z
date: Fri, 15 Mar 2024 15:07:40 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301245_1SIH6VK53RU240WOI&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301245_1SIH6VK53RU240WOI&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 289583
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CFBE3E0BE1E943CFBC08160B65F7BB6A Ref B: LON04EDGE0616 Ref C: 2024-03-15T15:07:41Z
date: Fri, 15 Mar 2024 15:07:40 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418591_10FJHPMA48A1P20JW&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239340418591_10FJHPMA48A1P20JW&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 167585
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C2EC57B42AC340C9A7F6A960E0094569 Ref B: LON04EDGE0616 Ref C: 2024-03-15T15:07:41Z
date: Fri, 15 Mar 2024 15:07:40 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301654_1QFI75P42YM2SO877&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301654_1QFI75P42YM2SO877&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 253117
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 06950C83E7074CD9AE9F94734B2C0FA3 Ref B: LON04EDGE0616 Ref C: 2024-03-15T15:07:42Z
date: Fri, 15 Mar 2024 15:07:41 GMT
-
1.3kB 9.5kB 17 15
-
1.3kB 9.5kB 17 15
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239317301654_1QFI75P42YM2SO877&pid=21.2&w=1080&h=1920&c=4tls, http270.6kB 2.0MB 1454 1445
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301465_1IH9IDA0LGHTED0D3&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301032_1O1TBR912QG5BWWX0&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418592_1RYDTURC2A8KOBZ9U&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301245_1SIH6VK53RU240WOI&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418591_10FJHPMA48A1P20JW&pid=21.2&w=1080&h=1920&c=4HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301654_1QFI75P42YM2SO877&pid=21.2&w=1080&h=1920&c=4HTTP Response
200 -
1.3kB 9.5kB 17 15
-
1.3kB 9.5kB 17 15
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
74 B 141 B 1 1
DNS Request
107.211.222.173.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
76.32.126.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
26.35.223.20.in-addr.arpa
-
216 B 158 B 3 1
DNS Request
209.205.72.20.in-addr.arpa
DNS Request
209.205.72.20.in-addr.arpa
DNS Request
209.205.72.20.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
79.121.231.20.in-addr.arpa
DNS Request
79.121.231.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
30.243.111.52.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
241.150.49.20.in-addr.arpa
DNS Request
241.150.49.20.in-addr.arpa
-
144 B 137 B 2 1
DNS Request
18.134.221.88.in-addr.arpa
DNS Request
18.134.221.88.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
190.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
88.156.103.20.in-addr.arpa
-
62 B 173 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200