VmLauncher[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VmLauncher.exe
Size 4.7MB
Sample260619-phr8dsfy2n
SHA256 00e6faec6a3b45086a44e520caf3d4b82e7594f2f9d76ea459c1d4f3bd3de195
MD5 4372eb54d23693d17b842d040b571abb
SHA1 f279767bab210504beb5a083a145be2ee2155106
SHA512 7e7c9aa22cfb48cfa96b363b065e4404a4774b42d91f4c51b3c640dad7e5f8031bd6cd79e60b4694ad90a4d384a40a48f598affdb0ebd9fa7daed2a554856d03
SSDEEP 49152:DrqFvXLe0KcW8Lmx1C+jninZ8KBDEMBXVt8slYqbeg/CVzLSb8s5UmuqG1wvI9/P:DrqZxKt1wswTbeu2
TLSH
T1C9366B313149C43BD5A207702CAAE79A613C7E769FA6D9D372C89B5F05312C2CA35E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

VmLauncher.exe

.exe 4.7MB

VmLauncher.exe

IMPHASH 6348ab4c13466ad5b26be39bcaac8a74
SHA256 00e6faec6a3b45086a44e520caf3d4b82e7594f2f9d76ea459c1d4f3bd3de195
MD5 4372eb54d23693d17b842d040b571abb
SHA1 f279767bab210504beb5a083a145be2ee2155106
SHA512 7e7c9aa22cfb48cfa96b363b065e4404a4774b42d91f4c51b3c640dad7e5f8031bd6cd79e60b4694ad90a4d384a40a48f598affdb0ebd9fa7daed2a554856d03
SSDEEP 49152:DrqFvXLe0KcW8Lmx1C+jninZ8KBDEMBXVt8slYqbeg/CVzLSb8s5UmuqG1wvI9/P:DrqZxKt1wswTbeu2
TLSH
T1C9366B313149C43BD5A207702CAAE79A613C7E769FA6D9D372C89B5F05312C2CA35E1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

90:98:54:ad:10:32:cf:31:da:dd:fd:f9:82:14:9a:24:b8:ab:93:e9:27:4b:f2:bc:7f:72:ee:08:3f:0f:a1:95

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Caphyon SRL,O=Caphyon SRL,L=Craiova,C=RO

Chains

Jan 29, 2025

CN=Caphyon SRL,O=Caphyon SRL,L=Craiova,C=RO

CN=Microsoft ID Verified CS EOC CA 01,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Caphyon SRL,O=Caphyon SRL,L=Craiova,C=RO

Serial Number

33:00:01:95:04:1b:e4:c9:07:11:f8:f9:81:00:00:00:01:95:04

Issuer

CN=Microsoft ID Verified CS EOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 28, 2025 - Jan 31, 2025

Subject

CN=Microsoft ID Verified CS EOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:06:4a:1a:fa:cf:05:61:6a:74:00:00:00:00:00:06

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:C392-9641-4540,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:3d:d1:9f:e2:d4:41:cd:e3:40:00:00:00:00:00:3d

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 18, 2024 - Apr 17, 2025

Minor OS version

Major OS version

Entry point

1872432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ReleaseAI\win\Release\bin\x86\VmLauncher.pdb

msi

ord159 ord32 ord78 ord150 ord92 ord8 ord118 ord160

kernel32

MoveFileW GetTempFileNameW GetTempPathW CreateDirectoryW RemoveDirectoryW CopyFileW GetEnvironmentStringsW SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo InitializeCriticalSection GetConsoleOutputCP SetConsoleOutputCP FlushFileBuffers SetUnhandledExceptionFilter TerminateProcess GetSystemFirmwareTable ReadProcessMemory LoadLibraryExA ExpandEnvironmentStringsA OpenEventW GetLogicalDrives GetTickCount GetProcessId LocalFree DecodePointer GetProcessTimes GetSystemTimes OpenProcess GetCurrentProcessId ResetEvent SetEvent CreateEventW CreateThread TerminateThread SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileSizeEx SetFilePointerEx ReadConsoleW ReadConsoleInputW SetConsoleMode GetConsoleMode EnumSystemLocalesW GetExitCodeThread IsValidLocale LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation GetFileType ExitProcess GetConsoleCP FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetStartupInfoW UnhandledExceptionFilter GetLocaleInfoEx WaitForSingleObject CompareStringW GetModuleHandleW VerSetConditionMask VerifyVersionInfoW Sleep SetFilePointer ReadFile FindNextFileW GetLocaleInfoW lstrcmpiW MultiByteToWideChar GetEnvironmentVariableW GetProcAddress GetModuleFileNameW GetWindowsDirectoryW GetSystemDirectoryW GetConsoleWindow MulDiv GetCurrentProcess WideCharToMultiByte WriteFile CloseHandle CreateFileW DeleteFileW LoadLibraryExW SetLastError lstrlenW FindClose FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap GetCPInfo LCMapStringEx GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize GetTickCount64 FormatMessageW Process32NextW Process32FirstW CreateToolhelp32Snapshot SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive WaitForSingleObjectEx OutputDebugStringW IsDebuggerPresent VirtualFree VirtualAlloc IsProcessorFeaturePresent HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy RaiseException GetCurrentThreadId LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionEx GetLastError DeleteCriticalSection GetExitCodeProcess CreateProcessW GetTimeFormatW FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer GetComputerNameExW CopyFileExW GetPrivateProfileSectionW CompareStringEx SetConsoleTitleW AllocConsole FreeConsole AttachConsole DeviceIoControl QueryPerformanceCounter QueryPerformanceFrequency DuplicateHandle GetCurrentThread LocalAlloc Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection GetModuleFileNameA GetDateFormatW LoadLibraryA GetFullPathNameW FindFirstFileW ExpandEnvironmentStringsW QueryDosDeviceW GetLogicalDriveStringsW MapViewOfFile CreateFileMappingW UnmapViewOfFile GetStringTypeW SetFileAttributesW GetFileAttributesW GetShortPathNameW FreeLibrary LoadLibraryW GetUserDefaultLCID GetSystemInfo VirtualProtect VirtualQuery GetFileSize InitializeCriticalSectionAndSpinCount DebugBreak lstrcpynW GetSystemTimeAsFileTime

user32

EndDialog GetWindow GetMonitorInfoW PostMessageW GetParent MapWindowPoints GetSystemMenu CreateWindowExW OffsetRect DialogBoxParamW DeleteMenu DestroyMenu EnableWindow IsWindow DestroyWindow SetWindowTextW SetWindowPos RegisterClassExW GetClassInfoExW MonitorFromWindow SendMessageW GetWindowLongW ScreenToClient GetWindowRect GetDlgItem GetClientRect SetWindowLongW GetActiveWindow UnregisterClassW GetDC LoadCursorW SetCursorPos LoadMenuW GetSubMenu MonitorFromPoint GetPropW PostQuitMessage RegisterWindowMessageW CreateDialogParamW SetPropW RemovePropW DestroyIcon MessageBoxW DrawIconEx GetCursor MessageBeep SetDlgItemTextW SetScrollInfo ScrollWindowEx SetScrollPos GetScrollInfo KillTimer GetForegroundWindow PeekMessageW SendInput GetSystemMetrics MonitorFromRect GetWindowPlacement SetWindowPlacement ModifyMenuW LoadImageW EnableMenuItem MoveWindow CopyRect GetComboBoxInfo GetMessagePos GetDesktopWindow TrackMouseEvent SetCursor SetCapture ReleaseCapture GetCapture GetCursorPos UpdateWindow CharNextW SetRectEmpty GetClassNameW DrawFocusRect GetFocus SystemParametersInfoW GetIconInfo GetAsyncKeyState GetNextDlgTabItem DrawTextExW MsgWaitForMultipleObjectsEx TranslateMessage DispatchMessageW AllowSetForegroundWindow GetWindowThreadProcessId AttachThreadInput LoadStringW SetForegroundWindow EnumWindows BringWindowToTop IsRectEmpty DialogBoxIndirectParamW keybd_event CharLowerW CharUpperW InvalidateRect SetRect DrawEdge CreatePopupMenu InsertMenuItemW TrackPopupMenu GetDlgCtrlID GetWindowDC EndPaint BeginPaint IsWindowVisible UnionRect SetParent ReleaseDC DrawTextW IntersectRect FillRect ShowWindow IsWindowEnabled GetWindowTextW GetSysColor SetTimer PtInRect ClientToScreen GetWindowTextLengthW GetKeyState LoadBitmapW SetFocus RedrawWindow CallWindowProcW DefWindowProcW

gdi32

GetObjectW CreateFontIndirectW CreatePen BitBlt GetStockObject ExtCreatePen CreatePatternBrush CreateBitmap PatBlt SetViewportOrgEx MoveToEx SetBkMode CreateCompatibleDC CreateCompatibleBitmap SelectObject CreateDIBSection SetTextColor DeleteDC GetTextExtentPoint32W DeleteObject GetDeviceCaps CreateFontW LineTo

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

QueryServiceStatusEx OpenServiceW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW GetSecurityDescriptorDacl OpenSCManagerW CloseServiceHandle FreeSid AllocateAndInitializeSid LookupAccountSidW RegOpenKeyExA RegQueryValueExA RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW OpenProcessToken RegCloseKey GetTokenInformation EqualSid CryptDecrypt CryptDestroyKey CryptEncrypt CryptDeriveKey IsTextUnicode CryptDestroyHash CryptHashData CryptReleaseContext CryptCreateHash CryptAcquireContextW RegEnumValueW

shell32

ShellExecuteW SHGetFolderPathW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc ShellExecuteExW ord155 SHGetFolderLocation SHBrowseForFolderW SHFileOperationW DragAcceptFiles

oleaut32

SysFreeString SysStringLen SysAllocStringByteLen VariantInit VariantClear SysAllocString SysAllocStringLen VariantChangeType VariantCopy SafeArrayCreate SafeArrayDestroy SafeArrayPutElement SafeArrayGetElement GetErrorInfo SetErrorInfo VarUI4FromStr SysStringByteLen

zlibai

unzLocateFile unzClose unzOpenW unzOpenCurrentFile unzReadCurrentFile unzCloseCurrentFile unzGetCurrentFileInfo

shlwapi

PathIsDirectoryW PathFileExistsW PathIsUNCW ord176

comctl32

ImageList_GetIcon ImageList_GetIconSize InitCommonControlsEx ImageList_AddMasked ImageList_Create PropertySheetW CreatePropertySheetPageW DestroyPropertySheetPage

msimg32

GradientFill AlphaBlend

imagehlp

SymFunctionTableAccess SymGetModuleBase StackWalk SymGetLineFromAddr SymSetSearchPath SymCleanup SymInitialize SymSetOptions

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

HttpSendRequestExW HttpAddRequestHeadersW HttpOpenRequestW InternetConnectW HttpEndRequestW InternetOpenW InternetCloseHandle InternetSetCookieW InternetCrackUrlW InternetCreateUrlW InternetWriteFile HttpQueryInfoW InternetReadFile InternetSetOptionW InternetQueryOptionW

ws2_32

select accept connect getsockopt getpeername inet_ntoa send recv shutdown getsockname ntohl listen htonl gethostbyname WSAStartup WSACleanup bind socket WSAGetLastError closesocket ioctlsocket htons

psapi

GetModuleFileNameExW GetMappedFileNameW

netapi32

NetLocalGroupAdd NetApiBufferFree NetShareGetInfo NetLocalGroupGetInfo NetUserGetInfo NetUserDel NetUserAdd NetShareDel NetLocalGroupAddMembers NetLocalGroupDel NetShareAdd NetLocalGroupGetMembers

iphlpapi

GetAdaptersAddresses

urlmon

FindMimeFromData

mpr

WNetGetConnectionW

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

1024B

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

155KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

379KB

Virtual Size

379KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VmLauncher.exe

msi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

oleaut32

zlibai

shlwapi

comctl32

msimg32

imagehlp

version

wininet

ws2_32

psapi

netapi32

iphlpapi

urlmon

mpr

generic