vgc[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
vgc.exe
Size 102.5MB
Sample261014-epaa2sysdx
SHA256 b497471091946bc7a6fe8f888b6b84114fb3857a377e4403729c7d3508e450a9
MD5 3398e32fd67c15cf4b0c222f8da6aa48
SHA1 d7505b45b1705179e06e31301d71e4ed8f174b23
SHA512 6c0b8ab3bdb2535669732c65900a4fb07992c6c672994ef1a61639ee550e190558efe7dce07f6059f09d520a8d7e300ad5e2476a2f63e91510efa50f8f440c62
SSDEEP 393216:d+i9vbgVejABoFiBQdg8BeaaC7lyeDLQGGqnXZCbjxMY++lO:dnxiyBeaxyeDLHpCbL++lO
TLSH
T19938F7A3EAF3C3D0C09AB93EC37DF223EA217A0DDA35B2AF5F57954121792819164711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
vgc.exe

File Explorer

vgc.exe

.exe 102.5MB

vgc.exe

IMPHASH 845fafe52454bcbc349faf81c45c4bc9
SHA256 b497471091946bc7a6fe8f888b6b84114fb3857a377e4403729c7d3508e450a9
MD5 3398e32fd67c15cf4b0c222f8da6aa48
SHA1 d7505b45b1705179e06e31301d71e4ed8f174b23
SHA512 6c0b8ab3bdb2535669732c65900a4fb07992c6c672994ef1a61639ee550e190558efe7dce07f6059f09d520a8d7e300ad5e2476a2f63e91510efa50f8f440c62
SSDEEP 393216:d+i9vbgVejABoFiBQdg8BeaaC7lyeDLQGGqnXZCbjxMY++lO:dnxiyBeaxyeDLHpCbL++lO
TLSH
T19938F7A3EAF3C3D0C09AB93EC37DF223EA217A0DDA35B2AF5F57954121792819164711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

106434320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetUserObjectInformationW MessageBoxW wsprintfW GetProcessWindowStation ExitWindowsEx

wldap32

ord79 ord200 ord143 ord60 ord33 ord30 ord35 ord301 ord50 ord46 ord32 ord41 ord211 ord22 ord27 ord26

ntdll

NtWriteFile NtQueryInformationFile NtAllocateVirtualMemory RtlUnwind RtlVirtualUnwind NtUnmapViewOfSection RtlCaptureContext RtlAddFunctionTable NtMapViewOfSection RtlUnwindEx NtCreateSection NtWaitForSingleObject ZwQuerySystemInformation NtTerminateProcess RtlAddVectoredContinueHandler RtlLookupFunctionEntry NtCreateEvent NtFlushBuffersFile NtFsControlFile RtlPcToFileHeader NtFreeVirtualMemory NtTerminateThread LdrLoadDll NtReadFile NtReadVirtualMemory RtlDeleteFunctionTable NtProtectVirtualMemory NtWriteVirtualMemory NtQueryVirtualMemory NtClose NtDeviceIoControlFile VerSetConditionMask NtCreateThreadEx NtCreateFile

iphlpapi

GetBestRoute GetIpNetTable

shell32

ShellExecuteExW CommandLineToArgvW SHGetKnownFolderPath

ws2_32

setsockopt send ntohl select recvfrom accept WSASetLastError getaddrinfo recv ntohs WSACloseEvent htons listen sendto socket getservbyport gethostname ioctlsocket connect WSAEnumNetworkEvents htonl WSAEventSelect WSAResetEvent __WSAFDIsSet WSAWaitForMultipleEvents getsockname inet_ntoa gethostbyaddr getsockopt shutdown WSAIoctl WSAStartup closesocket WSAGetLastError gethostbyname inet_addr WSACreateEvent WSACleanup bind freeaddrinfo getservbyname

advapi32

RegQueryValueExW CreateServiceW BuildSecurityDescriptorW FreeSid ChangeServiceConfigW RegDeleteKeyValueW QueryServiceStatus StartServiceCtrlDispatcherW SetSecurityDescriptorDacl SystemFunction036 CryptGenRandom InitiateShutdownW SetTokenInformation SetServiceStatus DuplicateTokenEx RegDeleteKeyW CryptAcquireContextW LookupPrivilegeValueW AdjustTokenPrivileges CryptReleaseContext RegisterEventSourceW RegCreateKeyExW ControlService SetServiceObjectSecurity OpenProcessToken QueryServiceConfigW RegSetValueExW CryptAcquireContextA InitializeSecurityDescriptor RegOpenKeyExW CreateProcessAsUserW AllocateAndInitializeSid GetTokenInformation OpenServiceW RegGetValueW DeregisterEventSource OpenSCManagerW StartServiceW CloseServiceHandle RegisterServiceCtrlHandlerExW EqualSid RegCloseKey ReportEventW QueryServiceObjectSecurity DeleteService

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrust

wtsapi32

WTSSendMessageW WTSQueryUserToken WTSEnumerateSessionsW WTSFreeMemory

crypt32

CryptMsgClose CertCloseStore CryptQueryObject CryptMsgGetParam CertVerifyTimeValidity

bcrypt

BCryptGenRandom

ole32

CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeEx

kernel32

GetOEMCP GetFileSizeEx SleepEx TlsSetValue CreateToolhelp32Snapshot MoveFileExA TerminateProcess GetEnvironmentStringsW ReadConsoleW HeapSize QueryPerformanceCounter GetModuleHandleW GetFileAttributesW FileTimeToSystemTime AllocConsole FlsSetValue LoadLibraryExW WaitForSingleObjectEx CloseHandle UnhandledExceptionFilter GetStdHandle GetModuleHandleA VirtualAlloc ConnectNamedPipe UpdateProcThreadAttribute AcquireSRWLockShared FreeLibraryAndExitThread GetCommandLineW InitializeCriticalSection Process32NextW HeapReAlloc GetExitCodeThread TlsGetValue MultiByteToWideChar FindFirstFileExW GetEnvironmentVariableW GlobalMemoryStatusEx GetExitCodeProcess IsDebuggerPresent SetInformationJobObject VirtualFree ProcessIdToSessionId GetEnvironmentVariableA ExitProcess SetConsoleMode CompareStringW CreateDirectoryW SystemTimeToFileTime GetSystemTimeAsFileTime GetWindowsDirectoryW SetConsoleTextAttribute TlsFree K32GetProcessImageFileNameW ExitThread WaitForSingleObject InitOnceBeginInitialize GetCurrentDirectoryW GetLocaleInfoEx SetPriorityClass OpenProcess GetCurrentThreadId FreeEnvironmentStringsW ReleaseSRWLockExclusive FlsGetValue CreateThread GetConsoleOutputCP GetFileInformationByHandleEx SetStdHandle CreateFileW VirtualProtect SetThreadPriority DeleteFileW FindClose GetStartupInfoW TryEnterCriticalSection AssignProcessToJobObject InterlockedPushEntrySList FlushFileBuffers AcquireSRWLockExclusive GetModuleFileNameA LeaveCriticalSection FlsAlloc HeapQueryInformation GetConsoleMode ConvertThreadToFiber SetEnvironmentVariableW InitializeSListHead GetTickCount TryAcquireSRWLockExclusive SleepConditionVariableSRW ResumeThread GetACP GetProcAddress DeleteCriticalSection GetTickCount64 GetSystemWindowsDirectoryW GetCommandLineA FlsFree DecodePointer CreateFiber FormatMessageW CreateNamedPipeW DebugBreak GetCurrentProcessId ReadFile SetLastError GetFinalPathNameByHandleW MoveFileExW GetModuleFileNameW GetUserDefaultLCID TlsAlloc SetFilePointer SetUnhandledExceptionFilter EnterCriticalSection ReleaseSRWLockShared GetDriveTypeW CopyFileW LCMapStringW RaiseException LCMapStringEx InitializeProcThreadAttributeList GetModuleHandleExW GetSystemFirmwareTable CreateProcessW EnumSystemLocalesW FindFirstFileW GetLastError GetCPInfo FormatMessageA LoadLibraryW PeekNamedPipe GetConsoleScreenBufferInfo VerifyVersionInfoW GetTimeFormatW DisconnectNamedPipe EncodePointer HeapFree OutputDebugStringW GetStringTypeW GetLocaleInfoW CreateEventW GetFullPathNameW GetSystemTime SystemTimeToTzSpecificLocalTime CreateMutexW ConvertFiberToThread Sleep WakeAllConditionVariable WTSGetActiveConsoleSessionId LocalFree SetEndOfFile GetFileInformationByHandle SetFilePointerEx InitializeCriticalSectionAndSpinCount GetTimeZoneInformation GetSystemDirectoryA CreateEventA GetDateFormatW WriteConsoleW GetFileType GetCurrentProcess WideCharToMultiByte AreFileApisANSI OpenEventW DeleteProcThreadAttributeList DeleteFiber GetProcessHeap HeapAlloc IsValidLocale FindNextFileW LoadLibraryA Process32FirstW GetSystemTimes GetFileTime QueryPerformanceFrequency SetFileInformationByHandle ReadConsoleA IsProcessorFeaturePresent FreeLibrary CreateJobObjectW SetEvent IsValidCodePage WriteFile WaitForMultipleObjects InitOnceComplete SetConsoleCtrlHandler InitializeCriticalSectionEx SwitchToFiber GetFileAttributesExW

Name

.text

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

85KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

172KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.toir

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.grfn1

Size

87.8MB

Virtual Size

87.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.riot0

Size

1.5MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.riot1

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_WRITE

generic

count=210, id=261, version=33145,

count=26, id=260, version=33145,

count=11, id=259, version=33145,

count=7, id=253, version=35207,

count=19, id=260, version=35207,

count=12, id=259, version=35207,

count=102, id=261, version=35207,

count=4, id=261, version=35225,

count=1, id=262, version=33145,

count=31, id=257, version=33145,

count=410, id=1, productName=Unmarked objects,

count=1, id=260, version=35222,

count=1, id=259, version=24234,

count=41, id=261, version=33135,

count=1, id=259, version=33135,

count=6, id=260, version=33135,

count=32, productName=Unmarked objects (old),

count=762, id=260, version=30153,

count=119, id=260, version=34120,

count=23, id=261, version=34120,

count=52, id=260, version=33523,

count=39, id=265, version=35225,

count=1, id=259, version=35225,

count=1, id=255, version=35225,

count=1, id=151,

count=1, id=258, version=35225,