Overview

overview

7

Static

static

3

VanatorTweakSetup.exe

windows10-2004-x64

7

VanatorTweakSetup.exe

windows11-ltsc_2024-x64

7

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...rd.bmp

windows10-2004-x64

1

$PLUGINSDI...rd.bmp

windows11-ltsc_2024-x64

1

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

VanatorTweak.exe

windows10-2004-x64

5

VanatorTweak.exe

windows11-ltsc_2024-x64

5

Sharing

Copy URL Twitter E-mail

General

  • Target
    VanatorTweakSetup.exe
  • Size 53.3MB
  • Sample260907-2cpxashl6t
  • SHA256 dcf60567f611a41c9eb675df4b84c32e2a0017bdb38cf25a0319a263b063fcc4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Targets

    • Target
      VanatorTweakSetup.exe
    • Size 53.3MB
    • SHA256 dcf60567f611a41c9eb675df4b84c32e2a0017bdb38cf25a0319a263b063fcc4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/modern-wizard.bmp
    • Size 25KB
    • SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      VanatorTweak.exe
    • Size 57.3MB
    • SHA256 91d8fd469b409539c5c0314109576a4c14ed50bfe4188cb668cd6204076e964d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral10behavioral9

MITRE ATT&CK Enterprise v16

Tasks