vault.pdb
Static task
static1
Behavioral task
behavioral1
Sample
Vault.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Vault.dll
Resource
win10v2004-20240426-en
General
-
Target
Vault.dll
-
Size
659KB
-
MD5
8ea7efba9db78db6ff631801384508f7
-
SHA1
5b6a442592bebdc16a575e7b24b024d43da50278
-
SHA256
a9ad297d26509b91788fe232499f098d88e2a7afe7fc47e05cce1c423417edac
-
SHA512
634b8c5cc57a8cd6e80132c166447973ef76154251657c90b5048a71210d7e7d088090f90c8232ad9730bb88351ead5da448419473c466d798fe8ade0224e63a
-
SSDEEP
6144:I2C9kDjdwc/7dZI16OWYDz0qc9SlUqc9Sl4T2fg8XXRtr+wkMl1EN/dpR2D:I2CKtZI1VWI0MGMPZX1D0k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Vault.dll
Files
-
Vault.dll.dll windows:6 windows x86 arch:x86
5c5223375c090039782569bdd32d7e98
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
memcpy
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
wcscpy_s
?what@exception@@UBEPBDXZ
memcpy_s
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
memmove_s
??0exception@@QAE@XZ
_vsnwprintf_s
free
malloc
_vsnwprintf
__RTDynamicCast
memcmp
__CxxFrameHandler3
_CxxThrowException
_callnewh
tolower
_purecall
memset
kernel32
DelayLoadFailureHook
ResolveDelayLoadedAPI
LoadLibraryExW
GetModuleFileNameW
OutputDebugStringA
CompareStringOrdinal
LocalSize
FileTimeToLocalFileTime
GetCurrentThread
GetDateFormatW
FileTimeToSystemTime
GetSystemTime
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
Sleep
LocalAlloc
CloseHandle
CreateProcessW
GetSystemDirectoryW
FormatMessageW
LocalFree
GetLastError
HeapFree
HeapAlloc
GetProcessHeap
DisableThreadLibraryCalls
ExpandEnvironmentStringsW
CompareFileTime
DeactivateActCtx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetProcAddress
GetModuleHandleW
CreateActCtxW
ReleaseActCtx
ActivateActCtx
advapi32
GetTraceLoggerHandle
CredEnumerateW
CredWriteW
CredDeleteW
ConvertSidToStringSidW
CredMarshalCredentialW
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
OpenThreadToken
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetLengthSid
CopySid
InitializeSid
GetTraceEnableLevel
GetSidSubAuthority
EqualSid
CredGetSessionTypes
CredUnmarshalCredentialW
CredFree
shlwapi
ord219
ord199
ord514
ord172
ord158
ord256
ord24
ord618
ord156
ord174
SHStrDupW
ord176
ord204
shell32
ord25
ord18
ShellExecuteExW
SHBindToObject
ord155
SHParseDisplayName
ole32
CoTaskMemFree
CoCreateInstance
oleaut32
VariantClear
SysAllocString
SysFreeString
user32
LoadImageW
LoadStringW
LoadCursorW
SetCursor
GetFocus
DestroyIcon
crypt32
CertCloseStore
CertGetEnhancedKeyUsage
CertOpenSystemStoreW
CertFreeCertificateChainList
CertAddSerializedElementToStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CertGetCertificateContextProperty
CertSelectCertificateChains
cryptui
CertSelectionGetSerializedBlob
credui
CredUIPromptForWindowsCredentialsW
CredUnPackAuthenticationBufferW
CredPackAuthenticationBufferW
dui70
?IsDescendent@XProvider@DirectUI@@UAGJPAVElement@2@PA_N@Z
?GetDesiredSize@XProvider@DirectUI@@UAGJHHPAUtagSIZE@@@Z
?SetParameter@XProvider@DirectUI@@UAGJABU_GUID@@PAX@Z
?AddRef@XProvider@DirectUI@@UAGKXZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?SetFocus@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?SetHandleEnterKey@XProvider@DirectUI@@IAEX_N@Z
?CreateDUI@XProvider@DirectUI@@UAGJPAVIXElementCP@2@PAPAUHWND__@@@Z
?GetRoot@XProvider@DirectUI@@IAEPAVElement@2@XZ
?Navigate@XProvider@DirectUI@@UAGJHPA_N@Z
?CanSetFocus@XProvider@DirectUI@@UAGJPA_N@Z
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UAGHGH@Z
?GetHostedElementID@XProvider@DirectUI@@UAGJPAG@Z
?ForceThemeChange@XProvider@DirectUI@@UAGJIJ@Z
?ClickDefaultButton@XProvider@DirectUI@@UAGHXZ
?SetRegisteredDefaultButton@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UAGJ_N@Z
?CreateXBaby@XProvider@DirectUI@@UAEJPAVIXElementCP@2@PAUHWND__@@PAVElement@2@PAKPAPAUIXBaby@2@@Z
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
InitProcessPriv
InitThread
?Initialize@XProvider@DirectUI@@QAEJPAVElement@2@PAVIXProviderCP@2@@Z
?Create@XResourceProvider@DirectUI@@SGJPAUHINSTANCE__@@PBG11PAPAV12@@Z
?QueryInterface@XProvider@DirectUI@@UAGJABU_GUID@@PAPAX@Z
??1XProvider@DirectUI@@UAE@XZ
??0XProvider@DirectUI@@QAE@XZ
?Click@Button@DirectUI@@SG?AVUID@@XZ
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?SetEncodedContentString@Element@DirectUI@@QAEJPBG@Z
UnInitProcessPriv
UnInitThread
?Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z
?GetStringNull@Value@DirectUI@@SGPAV12@XZ
?GetUnset@Value@DirectUI@@SGPAV12@XZ
?GetAtomZero@Value@DirectUI@@SGPAV12@XZ
?SetDefaultButtonTracking@XProvider@DirectUI@@UAGJ_N@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?GetEncodedContentString@Element@DirectUI@@QAEJPAGI@Z
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
??1Element@DirectUI@@UAE@XZ
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
??1Proxy@DirectUI@@UAE@XZ
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
??1CritSecLock@DirectUI@@QAE@XZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
??0Element@DirectUI@@QAE@XZ
??0Proxy@DirectUI@@QAE@XZ
??0ClassInfoBase@DirectUI@@QAE@XZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
StrToID
??0IDataEngine@DirectUI@@QAE@XZ
??1IDataEngine@DirectUI@@UAE@XZ
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?Release@Value@DirectUI@@QAEXXZ
?SetAccDesc@Element@DirectUI@@QAEJPBG@Z
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
GetElementDataEntry
?GetExpanded@Expandable@DirectUI@@QAE_NXZ
?GetClassInfoPtr@Expando@DirectUI@@SGPAUIClassInfo@2@XZ
??0IDataEntry@DirectUI@@QAE@XZ
??1IDataEntry@DirectUI@@UAE@XZ
?SetAbsorbsShortcut@Element@DirectUI@@QAEJ_N@Z
?FireEvent@Element@DirectUI@@QAEXPAUEvent@2@_N1@Z
?OnNotify@Combobox@DirectUI@@UAE_NIIJPAJ@Z
?Register@Combobox@DirectUI@@SGJXZ
?Initialize@Combobox@DirectUI@@QAEJIPAVElement@2@PAK@Z
?GetClassInfoPtr@Combobox@DirectUI@@SGPAUIClassInfo@2@XZ
??0Combobox@DirectUI@@QAE@XZ
??1Combobox@DirectUI@@UAE@XZ
?OnPropertyChanged@Combobox@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnInput@Combobox@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UAEXXZ
?OnEvent@HWNDHost@DirectUI@@UAEXPAUEvent@2@@Z
?Paint@HWNDHost@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@Combobox@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?SetKeyFocus@HWNDHost@DirectUI@@UAEXXZ
?MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?OnHosted@Combobox@DirectUI@@UAEXPAVElement@2@@Z
?OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UAE_NXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ
?OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSysChar@HWNDHost@DirectUI@@UAE_NG@Z
?RemoveLocalValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZ@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UAEXIPBUtagSTYLESTRUCT@@@Z
?OnAdjustWindowSize@Combobox@DirectUI@@UAEHHHI@Z
?SetWindowDirection@HWNDHost@DirectUI@@UAEXPAUHWND__@@@Z
?CreateHWND@Combobox@DirectUI@@UAEPAUHWND__@@PAU3@@Z
?EraseBkgnd@HWNDHost@DirectUI@@MAE_NPAUHDC__@@PAJ@Z
?SetActive@Element@DirectUI@@QAEJH@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?Register@Element@DirectUI@@SGJXZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?SetDataEngine@Repeater@DirectUI@@QAEXPAUIDataEngine@2@@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?SetBorderStyle@Element@DirectUI@@QAEJH@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
ntdll
WinSqmAddToStream
EtwLogTraceEvent
WinSqmSetDWORD
WinSqmEndSession
WinSqmStartSession
RtlNtStatusToDosError
NtAllocateLocallyUniqueId
RtlInitString
EtwTraceMessage
userenv
ord211
vaultcli
VaultCloseVault
VaultEnumerateVaults
VaultOpenVault
VaultGetInformation
VaultEnumerateItems
VaultRemoveItem
VaultGetItem
VaultAddItem
VaultGetItemType
VaultFree
secur32
GetUserNameExW
LsaFreeReturnBuffer
LsaLogonUser
LsaConnectUntrusted
LsaLookupAuthenticationPackage
LsaDeregisterLogonProcess
rpcrt4
UuidToStringW
RpcStringFreeW
Exports
Exports
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 206KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 417KB - Virtual size: 416KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ