Overview
overview
7Static
static
3MatDeckSetup.exe
windows7-x64
7MatDeckSetup.exe
windows10-2004-x64
7SCADA.exe
windows7-x64
1SCADA.exe
windows10-2004-x64
1SoftwareUp...in.exe
windows7-x64
1SoftwareUp...in.exe
windows10-2004-x64
1USBDEV_LIB.dll
windows7-x64
1USBDEV_LIB.dll
windows10-2004-x64
1VMD.exe
windows7-x64
1VMD.exe
windows10-2004-x64
7VirtumentU...al.pdf
windows7-x64
1VirtumentU...al.pdf
windows10-2004-x64
1XlsLib.dll
windows7-x64
1XlsLib.dll
windows10-2004-x64
3biodaq.dll
windows7-x64
1biodaq.dll
windows10-2004-x64
1biodaqutil.dll
windows7-x64
1biodaqutil.dll
windows10-2004-x64
1ftd2xx.dll
windows7-x64
1ftd2xx.dll
windows10-2004-x64
1imageformats/qgif.dll
windows7-x64
1imageformats/qgif.dll
windows10-2004-x64
1imageforma...eg.dll
windows7-x64
1imageforma...eg.dll
windows10-2004-x64
1imageformats/qsvg.dll
windows7-x64
1imageformats/qsvg.dll
windows10-2004-x64
1lessons/Le...nt.pdf
windows7-x64
1lessons/Le...nt.pdf
windows10-2004-x64
1lessons/Le...ph.pdf
windows7-x64
1lessons/Le...ph.pdf
windows10-2004-x64
1libMPSSE.dll
windows7-x64
1libMPSSE.dll
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 16:14
Behavioral task
behavioral1
Sample
MatDeckSetup.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
MatDeckSetup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
SCADA.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
SCADA.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
SoftwareUpdaterAdmin.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
SoftwareUpdaterAdmin.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
USBDEV_LIB.dll
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
USBDEV_LIB.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
VMD.exe
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
VMD.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
VirtumentUserManual.pdf
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
VirtumentUserManual.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
XlsLib.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
XlsLib.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
biodaq.dll
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
biodaq.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
biodaqutil.dll
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
biodaqutil.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
ftd2xx.dll
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
ftd2xx.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
imageformats/qgif.dll
Resource
win7-20240419-en
Behavioral task
behavioral22
Sample
imageformats/qgif.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
imageformats/qjpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
imageformats/qjpeg.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
imageformats/qsvg.dll
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
imageformats/qsvg.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
lessons/Lesson 1 - MatDeck document.pdf
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
lessons/Lesson 1 - MatDeck document.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
lessons/Lesson 9 - 3D graph.pdf
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
lessons/Lesson 9 - 3D graph.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
libMPSSE.dll
Resource
win7-20240611-en
Behavioral task
behavioral32
Sample
libMPSSE.dll
Resource
win10v2004-20240611-en
General
-
Target
XlsLib.dll
-
Size
56KB
-
MD5
3b77f37e9f392d6482f995b21dd0d916
-
SHA1
0a2a9aad5c1b0618e7c594de03a675fd34afb916
-
SHA256
09cf0fd2e5c0685c97083fe40804855105db21c5a6156585614469ff3be42c92
-
SHA512
5e8f2883deb78df439e7604898feb06e736883a9b57fe4fda047775e0ac66104aa1f30ebd4318fefdf81081cb3a56017ee8a4b04d25201988b74416f0653ed8d
-
SSDEEP
768:iv+/bR84mPeopQ19FCshRocMVHWzdIJSZ/SLFzalyQIA+GX7dY:xTRRNd19FCPRJ+uJSZqpzVA+ce
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3884 5028 WerFault.exe 89 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5088 wrote to memory of 5028 5088 rundll32.exe 89 PID 5088 wrote to memory of 5028 5088 rundll32.exe 89 PID 5088 wrote to memory of 5028 5088 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\XlsLib.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\XlsLib.dll,#12⤵PID:5028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 9163⤵
- Program crash
PID:3884
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4180,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:81⤵PID:3052
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5028 -ip 50281⤵PID:2800