VantUpdater[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VantUpdater.exe
Size 13.0MB
Sample260727-wtk2sabl2x
SHA256 b3833e3c0b6f83bcf36a52f28bad04199d0b0d79cc2a19bdf8fa3c925714ec26
MD5 a947fae5c2006aada2f07bd151de46ca
SHA1 59ccd9991b55f9e462c1f91639ac8307a85e8370
SHA512 f54e995fc4fd9f6bff7dfe03d43d092d1410278fdf951f4367565672bb6f0db2ab7911ba0db65029e1d71fe09806cfa0a5615f1a70279e6a556089071bc8f9ff
SSDEEP 98304:w7TLWaCLZ3I06iSTw9x9esCbsmR5LlXOlawFlr6KBkO+bxcQpSSpUjqQSQAx:wflCLZ3rSTw/9eHx+Qpnx
TLSH
T1C6D6E5217B5A99ACC15AC4B4834B4A724A7170CB0B35B9FF449496383F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VantUpdater.exe

File Explorer

VantUpdater.exe

.exe 13.0MB

VantUpdater.exe

IMPHASH de76047df0a4308e02cd6691f9218e9b
SHA256 b3833e3c0b6f83bcf36a52f28bad04199d0b0d79cc2a19bdf8fa3c925714ec26
MD5 a947fae5c2006aada2f07bd151de46ca
SHA1 59ccd9991b55f9e462c1f91639ac8307a85e8370
SHA512 f54e995fc4fd9f6bff7dfe03d43d092d1410278fdf951f4367565672bb6f0db2ab7911ba0db65029e1d71fe09806cfa0a5615f1a70279e6a556089071bc8f9ff
SSDEEP 98304:w7TLWaCLZ3I06iSTw9x9esCbsmR5LlXOlawFlr6KBkO+bxcQpSSpUjqQSQAx:wflCLZ3rSTw/9eHx+Qpnx
TLSH
T1C6D6E5217B5A99ACC15AC4B4834B4A724A7170CB0B35B9FF449496383F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8987936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

VantUpdater.pdb

bcryptprimitives

ProcessPrng

advapi32

EventSetInformation EventRegister RegCloseKey EventWriteTransfer EventUnregister RegOpenKeyExW RegQueryValueExW RegGetValueW RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW

ntdll

NtDeviceIoControlFile NtCancelIoFileEx RtlNtStatusToDosError NtCreateFile NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlGetVersion

kernel32

GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW CreateThread SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar CancelIo QueryPerformanceFrequency GetSystemInfo GetWindowsDirectoryW SleepEx ReadFileEx WaitForMultipleObjects ExitProcess GetTempPathW GetFullPathNameW SetEnvironmentVariableW FindClose FindFirstFileExW GetFinalPathNameByHandleW DeleteFileW CreateEventW SwitchToThread CreateProcessW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetLastError GetProcessHeap HeapFree LoadLibraryExW CreateDirectoryW MoveFileExW FreeLibrary CopyFileExW GetCommandLineW InitializeCriticalSectionEx GetEnvironmentStringsW GetCurrentDirectoryW WriteFileEx SetLastError GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetSystemTimePreciseAsFileTime SetFileInformationByHandle SetFilePointerEx ReleaseMutex GetFileInformationByHandleEx CreateMutexA GetCurrentProcessId QueryPerformanceCounter WaitForSingleObjectEx WideCharToMultiByte HeapReAlloc LoadLibraryExA GetEnvironmentVariableW HeapAlloc GetExitCodeProcess GetUserDefaultUILanguage LCIDToLocaleName GetModuleHandleA Sleep FormatMessageW GetProcessId GetQueuedCompletionStatusEx CancelIoEx WriteFile ReadFile PostQueuedCompletionStatus GetOverlappedResult SetFileCompletionNotificationModes CreateIoCompletionPort CreatePipe GetFileAttributesW CreateFileW GetFileInformationByHandle GetConsoleMode CloseHandle SetNamedPipeHandleState ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime RtlPcToFileHeader TerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW RaiseException FlsAlloc SetHandleInformation FlsGetValue FlsSetValue FlsFree EncodePointer GetModuleHandleW InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx LoadLibraryW GetCurrentThreadId GetProcAddress LoadLibraryA lstrlenW WaitForSingleObject DuplicateHandle GetCurrentProcess DeleteCriticalSection

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

user32

GetDC IsProcessDPIAware SetWindowRgn FindWindowExW GetWindowLongPtrW RegisterClassExW GetMessageA DispatchMessageA EnumChildWindows GetParent MsgWaitForMultipleObjectsEx SendMessageW RedrawWindow AdjustWindowRect SetCapture RegisterWindowMessageA ReleaseCapture IsIconic EnableWindow ScreenToClient GetWindowLongW IsWindowEnabled SetParent MapWindowPoints GetWindow SetWindowLongPtrW DestroyIcon GetWindowRect VkKeyScanW ReleaseDC ShowWindow CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu SetMenuItemInfoW AppendMenuW InsertMenuW TrackPopupMenu GetClientRect PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar SetMenu DrawIconEx DrawTextW GetWindowDC SetFocus OffsetRect ClientToScreen MonitorFromRect GetMenuBarInfo GetMenuItemInfoW CreateIcon ToUnicodeEx GetKeyState GetAsyncKeyState GetKeyboardState MapVirtualKeyExW SystemParametersInfoA SetPropW SetWindowLongW EnableMenuItem GetSystemMenu SetWindowTextW GetWindowTextW GetWindowTextLengthW SendInput SetForegroundWindow GetRawInputData GetKeyboardLayout GetMenu ShowCursor ClipCursor GetClipCursor MonitorFromPoint IsWindowVisible RegisterTouchWindow IsWindow CreateWindowExW SetWindowDisplayAffinity AdjustWindowRectEx GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW FlashWindowEx DefWindowProcW GetMessageW EnumDisplayMonitors MapVirtualKeyW TranslateAcceleratorW LoadCursorW PostMessageW GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn SetWindowPos DestroyMenu DispatchMessageW TranslateMessage GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect GetMonitorInfoW MonitorFromWindow GetCursorPos SetCursor GetSystemMetrics CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent SystemParametersInfoW RegisterRawInputDevices FillRect

ole32

OleInitialize RegisterDragDrop CoInitializeEx RevokeDragDrop CoUninitialize CoInitialize CoTaskMemAlloc CoCreateInstance CoTaskMemFree CoCreateFreeThreadedMarshaler

comctl32

DefSubclassProc TaskDialogIndirect RemoveWindowSubclass SetWindowSubclass

gdi32

CombineRgn BitBlt CreateSolidBrush SelectObject CreateCompatibleDC DeleteDC CreateRectRgn GetDeviceCaps CreateDIBSection DeleteObject SetTextColor SetBkMode

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shlwapi

SHCreateMemStream

shell32

SHGetKnownFolderPath ShellExecuteExW SHAppBarMessage ShellExecuteW SHCreateItemFromParsingName DragQueryFileW DragFinish ord190 ord155 SHOpenFolderAndSelectItems

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

secur32

AcquireCredentialsHandleA DecryptMessage EncryptMessage QueryContextAttributesW ApplyControlToken FreeCredentialsHandle AcceptSecurityContext DeleteSecurityContext InitializeSecurityContextW FreeContextBuffer

ws2_32

WSAStartup freeaddrinfo getaddrinfo WSACleanup WSAGetLastError bind WSASocketW WSAIoctl connect ioctlsocket setsockopt send WSASend recv getsockname getpeername getsockopt closesocket shutdown

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertCloseStore CertFreeCertificateChain CertDuplicateStore CertOpenStore

api-ms-win-crt-math-l1-1-0

round roundf floor trunc __setusermatherr pow

api-ms-win-crt-string-l1-1-0

strcpy_s wcslen wcscmp _wcsicmp

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-runtime-l1-1-0

terminate _set_app_type abort _configure_narrow_argv _crt_atexit _initialize_narrow_environment _get_initial_narrow_environment _register_onexit_function _initterm _initterm_e exit _exit _seh_filter_exe __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc calloc free _callnewh