Overview
overview
7Static
static
1McVulAP.dll
windows7-x64
7McVulAP.dll
windows10-2004-x64
7McVulAdmAgnt.exe
windows7-x64
1McVulAdmAgnt.exe
windows10-2004-x64
1McVulAlert.exe
windows7-x64
1McVulAlert.exe
windows10-2004-x64
1McVulCon.exe
windows7-x64
1McVulCon.exe
windows10-2004-x64
1McVulCtr.exe
windows7-x64
1McVulCtr.exe
windows10-2004-x64
1McVulDBU.dll
windows7-x64
7McVulDBU.dll
windows10-2004-x64
7McVulIns.dll
windows7-x64
1McVulIns.dll
windows10-2004-x64
1McVulODS.dll
windows7-x64
7McVulODS.dll
windows10-2004-x64
7McVulRes.dll
windows7-x64
1McVulRes.dll
windows10-2004-x64
1McVulSI.dll
windows7-x64
7McVulSI.dll
windows10-2004-x64
7McVulShm.dll
windows7-x64
7McVulShm.dll
windows10-2004-x64
7McVulUsrAgnt.exe
windows7-x64
1McVulUsrAgnt.exe
windows10-2004-x64
1McVulVer.dll
windows7-x64
7McVulVer.dll
windows10-2004-x64
7McWinUpd.dll
windows7-x64
7McWinUpd.dll
windows10-2004-x64
7VulJsRes.dll
windows7-x64
1VulJsRes.dll
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 09:48
Static task
static1
Behavioral task
behavioral1
Sample
McVulAP.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
McVulAP.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
McVulAdmAgnt.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
McVulAdmAgnt.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
McVulAlert.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral6
Sample
McVulAlert.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
McVulCon.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral8
Sample
McVulCon.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
McVulCtr.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
McVulCtr.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
McVulDBU.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral12
Sample
McVulDBU.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
McVulIns.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
McVulIns.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
McVulODS.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
McVulODS.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
McVulRes.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral18
Sample
McVulRes.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
McVulSI.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral20
Sample
McVulSI.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
McVulShm.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral22
Sample
McVulShm.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
McVulUsrAgnt.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
McVulUsrAgnt.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
McVulVer.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral26
Sample
McVulVer.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
McWinUpd.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral28
Sample
McWinUpd.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
VulJsRes.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral30
Sample
VulJsRes.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
McVulDBU.dll
-
Size
605KB
-
MD5
d6bdd3d5185f55f4fc0345d31dfdf303
-
SHA1
bda9afa97d6486d33da7513248d1a7a8cbf9d519
-
SHA256
f89c8e5cdc8ca28e2eefc681b65d9f83a62672d6f868a703484e20f0647bf378
-
SHA512
2e194e9e7703bcd2997a7c80f41ca77b4ca7298160a031c6467c9587fdb07ea9f415300ef0f26ae50d448857cc668a6034d99b0ddb5ce3ed40b4d079f2729375
-
SSDEEP
6144:6GqrCtG0VRe0DRH6WfOqxftj62qzpvaDqDob35z2fXct5ya67UeTQXAF2r7yrzTI:pBBFsRGgUecG2/yr7wKCKj40T8W2aR+J
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\McVulDBU.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Modifies registry class 34 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717}\ = "McVulDBUpdaterPlugin Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B}\1.0\ = "McVulDBUpdaterLib" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B}\1.0\0\win64 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11}\ = "IHWUpdaterPlugin" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11}\TypeLib\ = "{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11}\TypeLib\ = "{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717}\TypeLib\ = "{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11}\ = "IHWUpdaterPlugin" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\McVulDBU.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\McVulDBU.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B64EBEEB-A8B5-492F-B720-4E7E7005A717}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2BBB8BF9-5C87-4758-8CAE-DB9B215B2F7B}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9C8DAE31-DAEA-47A4-9B30-80D7D69D1B11}\ProxyStubClsid32 regsvr32.exe