MatrixDongleTDiGmbH

Hunt Hypothesis

This rule detects the presence of the MatrixDongleTDiGmbH YARA signature, which likely identifies a specific malware implant or tooling associated with hardware dongle emulation or license bypass mechanisms. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify compromised endpoints or staging environments where adversaries may be deploying lightweight tools to maintain persistence or evade standard license checks before escalating their attack.

YARA Rule

rule MatrixDongleTDiGmbH
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 [6] E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 [4] E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2 }
	$a1 = { E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF }

condition:
		$a0 or $a1 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: The MatrixDongleTDiGmbH YARA rule likely targets the specific binary or configuration files associated with the Matrix Dongle TDI (Time-Dependent Interpolation) software, often used in industrial automation or specific engineering workflows. A legitimate trigger occurs when an IT administrator deploys or updates this niche software on a workstation or server using a standard deployment tool like SCCM (System Center Configuration Manager) or Intune. The deployment process involves writing the executable and its license/dongle communication modules to disk, which matches the YARA signature.

  • Filter/Exclusion: Exclude files located in the specific installation directory (e.g., C:\Program Files\MatrixDongleTDiGmbH\ or C:\Program Files (x86)\MatrixDongleTDiGmbH\) or exclude the process msiexec.exe / ccmsetup.exe when the file path contains “MatrixDongleTDiGmbH”.

• Scenario: In environments using VMware Workstation or Hyper-V for virtualization, the dongle communication driver or service may be loaded within a guest OS or passed through to the host. If the YARA rule scans memory or disk images of virtual machines, it can trigger on the dongle’s communication library (e.g., tdi.dll or similar) that is legitimately loaded by the VMware Tools service or the Hyper-V Integration Services. This is particularly common in test/dev environments where engineers validate hardware-dependent software.

  • Filter/Exclusion: Exclude processes related to virtualization management (e.g., vmware-usb.exe, vmtoolsd.exe, hvutils.exe) or exclude files residing in the virtual machine’s disk image paths (e.g., *.vmdk, *.vhdx) if the scan is disk-based,