vanta[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

vanta.rar
Size

3.5MB
MD5

76c001fa47218c502d5e3f00e68ad01d
SHA1

c8f21c71621f51ef0b77ef1ad1ce9539302fdbab
SHA256

58e9045e36bd1cbcf29b258f5eee8381b59e139e91e804e62fdea59fc96a93c9
SHA512

560dc6f6f2909e5efb825827d386c8ecfa97e46867db36e264ab773d6986321a345d8c61bdccb99247b05ba014f029abad96b15b4d8f1a016dc2d46ac5ad7ebf
SSDEEP

98304:LXmwNJa+7IwQvIn8GiV6Ylc2wWk/VIE8PfSGPqB:NXdEwnBElc2wW5du

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Injector.exe
unpack001/graith.exe
unpack001/vanta.dll

Files

vanta.rar
.rar
Injector.exe
.exe windows:6 windows x64 arch:x64

14c50bc42b703c5d594911d72a859ed2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAllocEx
CreateRemoteThread
SetConsoleTitleA
GetCurrentProcess
OpenProcess
GetProcAddress
CreateProcessA
FindClose
CloseHandle
LoadLibraryA
Sleep
WriteProcessMemory
GetLocaleInfoEx
FormatMessageA
LocalFree
FindFirstFileExW
FindNextFileW
AreFileApisANSI
GetLastError
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?good@ios_base@std@@QEBA_NXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy
__std_terminate
memmove
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memset
memcmp

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argc
exit
_exit
_initterm_e
_initterm
_initialize_narrow_environment
_configure_narrow_argv
_initialize_onexit_table
_set_app_type
_seh_filter_exe
_register_onexit_function
_crt_atexit
terminate
__p___argv
_invalid_parameter_noinfo_noreturn
_get_initial_narrow_environment

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
free
malloc

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
_getcwd

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
graith.exe
.exe windows:6 windows x64 arch:x64

0076f60d1969cc3b9a7a5eb6297bdc80

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

K32GetModuleInformation

user32

GetClientRect

advapi32

RegQueryValueExW

shell32

ShellExecuteExA

ole32

CoUninitialize

oleaut32

SysFreeString

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

msvcp140

?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

winhttp

WinHttpReceiveResponse

imm32

ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

normaliz

IdnToAscii

wldap32

ord143

crypt32

CertOpenStore

ws2_32

freeaddrinfo

userenv

UnloadUserProfile

wininet

InternetOpenUrlA

urlmon

URLDownloadToFileA

ntdll

RtlVirtualUnwind

vcruntime140

memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_exit

api-ms-win-crt-stdio-l1-1-0

_lseeki64

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

sqrtf

api-ms-win-crt-filesystem-l1-1-0

_unlink

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-locale-l1-1-0

localeconv

Sections

.text
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text0
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text1
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text2
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
vanta.dll
.dll windows:6 windows x64 arch:x64

8a2a0d18c4699fd428bed3e47a407e45

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
GetThreadContext
GetProcAddress
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
GetModuleHandleA
VirtualProtect
AcquireSRWLockExclusive
InitializeSListHead
GetSystemTimeAsFileTime
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
ReleaseSRWLockExclusive

msvcp140

_Thrd_detach
_Xtime_get_ticks
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset
memcpy
__C_specific_handler
memcmp
memmove
memchr
__std_terminate
__std_exception_copy
__std_exception_destroy
__current_exception_context
__std_type_info_destroy_list
__current_exception
_CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_initialize_narrow_environment
_cexit
_seh_filter_dll
_initterm_e
_initterm
_errno
_crt_atexit
_execute_onexit_table
terminate
_beginthreadex
_configure_narrow_argv
_register_onexit_function
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-convert-l1-1-0

strtod
strtoull
strtoll

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-math-l1-1-0

_dclass
_dsign

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14c50bc42b703c5d594911d72a859ed2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 512B - Virtual size: 172B

0076f60d1969cc3b9a7a5eb6297bdc80

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

d3d11

d3dcompiler_47

msvcp140

winhttp

imm32

dwmapi

normaliz

wldap32

crypt32

ws2_32

userenv

wininet

urlmon

ntdll

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 1.2MB

.rdata Size: - Virtual size: 1.4MB

.data Size: - Virtual size: 177KB

.pdata Size: - Virtual size: 59KB

.text0 Size: - Virtual size: 1.9MB

.text1 Size: 1024B - Virtual size: 568B

.text2 Size: 3.6MB - Virtual size: 3.6MB

.rsrc Size: 1KB - Virtual size: 1KB

8a2a0d18c4699fd428bed3e47a407e45

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 512B - Virtual size: 172B

.text
Size: - Virtual size: 1.2MB

.rdata
Size: - Virtual size: 1.4MB

.data
Size: - Virtual size: 177KB

.pdata
Size: - Virtual size: 59KB

.text0
Size: - Virtual size: 1.9MB

.text1
Size: 1024B - Virtual size: 568B

.text2
Size: 3.6MB - Virtual size: 3.6MB

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: 146KB - Virtual size: 146KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 2KB - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 512B - Virtual size: 204B