Malware and phishing analysis for manufacturing and automotive.
Production does not wait for an investigation, and a file wrongly held back costs as much as one wrongly released. Accurate verdicts your automation can act on, behavioral depth when an alert becomes an investigation, and clear evidence for every block-or-release call.
100+ Automotive and industrial manufacturers worldwide trust VMRay toAutomate alert validation and triage
Accelerate analysis and incident response
Decide with confidence what to block and what to release
What makes manufacturing defense different
Manufacturing has been the most attacked sector for years running. Three conditions change what an analysis layer has to do.
DOWNTIMEEvery hour of stopped production carries a direct cost
SUPPLY CHAINFiles and links arrive constantly from thousands of partners
IT AND OTA compromise on the IT side does not stay on the IT side
What VMRay provides manufacturing security teams
Three capabilities behind the three outcomes above.
01 / AUTOMATION Verdicts your automation can act on
Automation is only as reliable as the analysis feeding it. EDR alert validation, triage, and enrichment are the tasks that consume a team’s day, and they only automate cleanly when the verdict underneath is right.
- Definitive verdicts: malicious, suspicious, or benign
- Automated validation and enrichment of EDR and email alerts
- Scored IOCs structured for automated use
- Native integrations and REST API into EDR, SIEM, SOAR, and TIP
02 / ANALYSIS AND RESPONSE Clarity to accelerate analysis and response
Depth does not have to arrive as complexity. VMRay goes deep into the threat and returns a report that reads cleanly, which shortens investigations and lets junior analysts work on cases that would otherwise wait for a senior.
- Noise-free reports that crystallize complex analysis
- Full execution chain, including multi-step delivery that hides behind a benign first link
- Interactive analysis to click through a lure the way a user would
- Malware configuration extraction: C2 addresses, campaign detail
03 / CONFIDENCE Evidence to block what is malicious and release what is not
A false positive that quarantines a file the plant needs is its own kind of outage. Behavioral evidence tells you what a sample actually does, so a block holds up and an exception is made on more than a hunch.
- Observed behavior rather than reputation or appearance
- Verdict transparency: the specific factors behind every decision
- Granular data for threat hunting, detection engineering, and CTI
- Evasive and unknown malware analyzed in an environment it cannot detect
FIG 1 / SIGNAL · VERDICT · DEPTHHow analysis fits into the flow
Samples arrive from across the stack. Verdicts and indicators return to every system that needs them.
How manufacturers are using VMRay
A featured story, and two teams in their own words.
FEATURED CUSTOMER STORYHow a global automotive manufacturer scaled its SOC with VMRay
A leading automotive manufacturer put VMRay at the center of an automated workflow, using deep behavioral analysis to validate alerts, extract high-fidelity IOCs, and give analysts a clear report they can act on without reconstructing context from fragmented tools.
- EDR and email alerts validated and enriched automatically
- High-fidelity IOCs extracted from observed behavior
- Clear, noise-free reports that speed investigation
VMRay significantly eased our cybersecurity tasks, automating time-intensive processes and enhancing efficiency, particularly in EDR alert validation.
Security team
Global automotive manufacturerCUSTOMER QUOTEA big piece of our project was choosing a malware analysis platform and integrating it with the new SOAR system. With VMRay, the results always come back quickly, in under a minute. I can look at the PDF report, IOCs, and screen shots of malware executing. Having this capability in our SOAR is pretty awesome.
Jim, Cyber Security Team Lead
An American automotive aftermarket manufacturerCUSTOMER QUOTEWe have other tools in our kit that have sandboxing capabilities, but they’re just not as good. When we submit a file to VMRay we generally get faster results, and we have higher trust in those results.
Cybersecurity Architect
Global engineering conglomerateWhat this looks like in the product
One analysis, six views. Move through the tabs to follow a single sample from verdict to extracted configuration.
Click any tab to move through the analysisMALICIOUSDynamic Analysis ReportXjgkkltfdhdfhfjg.exeWindows Exe (x86-32)Remarks (1 / 1)Anti-Sleep Triggered (0x0200000E) — the overall sleep time of all monitored processes was truncated from 43 s to 10 s to reveal dormant functionality.VMRay Threat Identifiers 19 rules · 72 matchesScoreCategoryOperationCount5 / 5 Extracted Configuration Pikabot configuration was extracted 1A configuration for Pikabot was extracted from artifacts of the dynamic analysis.VMRay Threat Identifiers 19 rules · 72 matches Behaviour scoredScoreCategoryOperationCount1 / 5Discovery Enumerates running processes15 / 5Extracted Configuration Pikabot configuration was extracted1A configuration for Pikabot was extracted from artifacts of the dynamic analysisC2 recovered T1027 · Obfuscated Files or Information2 / 5Persistence Hides a known RMM tool11 / 5Defense Evasion Masquerades process name21 / 5Collection Reads clipboard contents10 / 5Execution Spawns child process3MITRE ATT&CK MatrixWindowsTechniques observed during dynamic analysis, mapped to tactics.Initial
AccessExecutionPersistencePrivilege
EscalationDefense
EvasionCredential
AccessDiscoveryLateral
MovementWindows Management InstrumentationScheduled TaskScheduled TaskRegistry Run Keys / Startup FolderScheduled TaskModify RegistryDisabling Security ToolsHidden WindowCredentials in FilesSystem Information DiscoverySecurity Software DiscoveryFile and Directory DiscoveryRemote File CopyHigh severity Medium Low 13 techniques · 8 tacticsGeneral168.55 KBsent,18.16 MBreceived6ports23817, 23759, 80, 53, 44325contacted IP addresses11files downloaded1malicious host detectedDNS22queries for22domains7queries returned errorsHTTP / S19URLs,13contacted servers26sessions detectedContacted infrastructure (25 IP addresses)DEGermany9USUnited States6FIFinland3CZCzechia2HUHungary2NLNetherlands2SGSingapore131 HostsRequestsSeverity185.215.113.44🇩🇪:2375965.108.69.168🇫🇮:16278185.215.113.35🇩🇪:80msdl.microsoft.com🇺🇸:443server5.trumops.com🇺🇸:443212.192.241.62🇨🇿:80iplogger.org🇺🇸:44391.219.236.207🇭🇺:80TCP Sessions (11)TLSSrc IPSrc PortDest IPDest Port✕192.168.0.3349865185.215.113.4423759✕192.168.0.3349452185.215.113.4423759✕192.168.0.3349360185.215.113.4423759✕192.168.0.3349758185.215.113.4423759✕192.168.0.3349551185.215.113.4423759✕192.168.0.3349649185.215.113.4423759Filter 93 other artifactsALL TYPES70FILE1URL64IP2PROCESS3TypeValueFileC:\Users\RDHJ0C~1\Desktop\5Dq6sWcmD.dll.ocx+2IP104.168.155.143IP167.172.248.70URLhttps://197.242.150.244:8080URLhttps://159.89.202.34URLhttps://206.189.28.199:8080URLhttps://45.235.8.30:8080URLhttps://201.94.166.162URLhttps://188.44.20.25URLhttps://183.111.227.137:8080DetailsRelated VTIs (1)URLhttps://197.242.150.244:8080Original URLshttps://197.242.150.244:8080CategoriesExtractedIP Addresses197.242.150.244User-Agents—5 / 5Malware ConfigurationA configuration for Pikabot was extracted from artifacts of the dynamic analysis.Extracted C2 commands recovered from memorystd::string::assign(&v45, "shi", 3ui64);
*(_QWORD *)sub_1800149DC((__int64 *)v61, (__int64)&v45) = func_shi;
// …
std::string::assign(&v45, "dij", 3ui64);
*(_QWORD *)sub_180014ADC((__int64 *)v61, (__int64)&v45) = func_dij;
// …
std::string::assign(&v45, "dex", 3ui64);
*(_QWORD *)sub_180014BDC((__int64 *)v61, (__int64)&v45) = func_dex;
// …
std::string::assign(&v45, "sdl", 3ui64);
*(_QWORD *)sub_180014CDC((__int64 *)v61, (__int64)&v45) = func_sdl;Extracted configuration Pikabot configuration was extracted Go to memory dumpIntegrations with your existing security stack
VMRay connects into the tools your team already runs. Verdicts and indicators move into EDR, SIEM, SOAR, and threat intelligence platforms through native connectors or the REST API, without manual handoff between consoles.
With VMRay, the results always come back quickly, in under a minute. I can look at the PDF report, IOCs, and screenshots of malware executing. Having this capability in our SOAR is pretty awesome.
Jim, Cyber Security Team Lead
American automotive aftermarket manufacturerAdditional resources
See VMRay on a threat from your environment
Submit a sample and see the verdict, the behavior, and the indicators returned.
