hangar-installer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
hangar-installer.exe
Size 2.3MB
Sample261018-rq7ddsft2w
SHA256 9264e7b3f8c9025c2e5f27e46556faed269b9505f44fea617046f335a9006257
MD5 3176b708f8254561e6838a12d2b6005c
SHA1 a5c37980cb2296504b7bd0dfb5fce046605f2e0c
SHA512 26a7017f8137efd5a149b7460033f0fd13b24ebf696b97be3a4f719ca39e30a0affc83772e2975a29ac56d48f9450ca1ccf06490c991a8e31a6593939d46833a
SSDEEP 49152:YI+A1B+2P9dc6i99xgFv/yF5zS/yc0vXv8KpizN6Ll4VXo3GiwcrpEgE6w8+yX7H:YIZnVdcriFv/OSL+QBylSY3XrfH
TLSH
T104B5332467D2CA7BD98584B273A2CF6BAECCB40321786782424DD27E35D4394897F7D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
hangar-installer.exe
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/skybound-hangar-updater.exe

File Explorer

hangar-installer.exe

.exe 2.3MB
$PLUGINSDIR/nsExec.dll

.dll 7KB
skybound-hangar-updater.exe

.exe 4.4MB

hangar-installer.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 9264e7b3f8c9025c2e5f27e46556faed269b9505f44fea617046f335a9006257
MD5 3176b708f8254561e6838a12d2b6005c
SHA1 a5c37980cb2296504b7bd0dfb5fce046605f2e0c
SHA512 26a7017f8137efd5a149b7460033f0fd13b24ebf696b97be3a4f719ca39e30a0affc83772e2975a29ac56d48f9450ca1ccf06490c991a8e31a6593939d46833a
SSDEEP 49152:YI+A1B+2P9dc6i99xgFv/yF5zS/yc0vXv8KpizN6Ll4VXo3GiwcrpEgE6w8+yX7H:YIZnVdcriFv/OSL+QBylSY3XrfH
TLSH
T104B5332467D2CA7BD98584B273A2CF6BAECCB40321786782424DD27E35D4394897F7D8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

skybound-hangar-updater.exe

IMPHASH 2a93696db49331bdda9f52f48b2aa1f2
SHA256 0a280ae06183cbc29ef8cb938d068991df976f6d637b2d3febd23e2802decf56
MD5 fdd2df3dd9d45ce26847cbb847c0f8fd
SHA1 2c0cbbe282377b6b1853e05f5e90056764754d4e
SHA512 7533ffd6802206c8435c3dc9b347d2a20bcddd1cb61f2d7bdcf995e42f6d066537ad55be9a61d14e5bcdc65d14bdcc6a01d0d37d0a9aacdd007295d45a73b658
SSDEEP 98304:kLQrhgK2xSpCixqKwh+lB+hvkQ8/3j7KZe0fJtZNQImYn+b:B+SsD7nfZNhmea
TLSH
T1D8267D07F29081E9C09EC078C39BA637EB72B8CD0925B69F17E45B112F26F906B1D759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3146480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

skybound_hangar_updater.pdb

shell32

DragQueryFileW DragFinish SHGetStockIconInfo SHGetKnownFolderPath ShellExecuteW SHAppBarMessage SHChangeNotify

advapi32

RegCreateKeyTransactedW RegQueryValueExW RegCreateKeyExW RegSetValueExW RegCloseKey RegDeleteValueW RegOpenKeyExW RegGetValueW RegDeleteTreeW RegOpenKeyTransactedW SystemFunction036 EventRegister EventSetInformation EventWriteTransfer EventUnregister

kernel32

LoadLibraryW GetModuleHandleA RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId WideCharToMultiByte ReleaseMutex FormatMessageW MultiByteToWideChar FlsAlloc GetModuleHandleExW FlsFree FlsSetValue IsThreadAFiber SetThreadStackGuarantee SleepEx SetHandleInformation GetSystemTimePreciseAsFileTime ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetExitCodeProcess SetWaitableTimer SwitchToThread WaitForSingleObject ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime IsDebuggerPresent GetModuleHandleW IsProcessorFeaturePresent GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext AddVectoredExceptionHandler SetEnvironmentVariableW GetProcAddress GetLastError TerminateProcess RtlPcToFileHeader DeleteCriticalSection SetLastError RaiseException SetFilePointerEx CreateWaitableTimerExW MoveFileExW DeleteFileW GetTempPathW EncodePointer GetFileAttributesW CreateProcessW CancelIo CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle SetFileTime TlsAlloc GetFullPathNameW CreateThread WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode InitializeCriticalSectionAndSpinCount GetStdHandle GetCurrentThread lstrlenW HeapReAlloc HeapFree GetSystemInfo LCIDToLocaleName CreateMutexA CreateFileW CancelIoEx WriteFile GetUserDefaultUILanguage SetFileCompletionNotificationModes CreateIoCompletionPort TlsGetValue HeapAlloc TlsSetValue TlsFree InitializeSListHead LoadLibraryExA FreeLibrary GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetFinalPathNameByHandleW FindNextFileW OutputDebugStringA OutputDebugStringW LoadLibraryExW FindFirstFileExW UnhandledExceptionFilter RemoveDirectoryW SetUnhandledExceptionFilter FindClose GetProcessHeap RtlUnwindEx GetCurrentThreadId LoadLibraryA CloseHandle Sleep CreateEventW

bcryptprimitives

ProcessPrng

ntdll

NtReadFile NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtWriteFile RtlGetVersion NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile

user32

SetWindowPos GetMessageA TranslateMessage GetIconInfo DispatchMessageA EnumChildWindows LoadImageW CloseTouchInputHandle MonitorFromRect ScreenToClient GetWindowLongPtrW TrackMouseEvent SystemParametersInfoW GetAsyncKeyState GetMessageW DispatchMessageW CreateIcon RegisterTouchWindow FlashWindowEx LoadCursorW SetCursor IsIconic UpdateWindow InvalidateRect SetCursorPos GetForegroundWindow FindWindowExW IsWindowEnabled EnableWindow IsWindowVisible GetWindowTextW PostThreadMessageW PeekMessageW GetWindowTextLengthW MsgWaitForMultipleObjectsEx CreateWindowExW DefWindowProcW GetRawInputData SetWindowTextW SetParent SetPropW GetKeyState SetCapture ToUnicodeEx GetKeyboardLayout RedrawWindow GetKeyboardState EnumDisplayMonitors MonitorFromPoint ShowCursor ClipCursor GetSystemMetrics GetClipCursor SetWindowDisplayAffinity ReleaseCapture RegisterRawInputDevices GetWindowPlacement SetWindowRgn GetMonitorInfoW GetParent SetWindowPlacement ChangeDisplaySettingsExW AdjustWindowRectEx GetMenu GetWindowLongW GetWindow SetWindowLongW GetSystemMenu InvalidateRgn RegisterWindowMessageA IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SetMenu EnableMenuItem CreatePopupMenu CreateMenu DrawIconEx GetDC AppendMenuW InsertMenuW VkKeyScanW DestroyIcon SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo GetMenuItemInfoW SystemParametersInfoA ShowWindow SendMessageW PostQuitMessage CreateAcceleratorTableW GetActiveWindow DestroyAcceleratorTable DestroyMenu RemoveMenu DrawMenuBar SetMenuItemInfoW DestroyWindow PostMessageW AdjustWindowRect TranslateAcceleratorW SetFocus RegisterClassExW MapVirtualKeyExW MapVirtualKeyW GetUpdateRect ValidateRect SetWindowLongPtrW GetTouchInputInfo

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

ole32

RegisterDragDrop RevokeDragDrop CoCreateInstance CoInitializeEx CoUninitialize OleInitialize

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

shlwapi

SHCreateMemStream

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

combase

CoCreateFreeThreadedMarshaler CoIncrementMTAUsage CoTaskMemFree CoTaskMemAlloc

gdi32

CombineRgn CreateCompatibleDC BitBlt CreateDIBSection CreateRectRgn SetTextColor DeleteDC SetBkMode GetDeviceCaps CreateSolidBrush GetDIBits DeleteObject SelectObject

imm32

ImmGetCompositionStringW ImmGetContext ImmReleaseContext

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

GetErrorInfo SysStringLen SysFreeString SetErrorInfo

ws2_32

shutdown send freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt bind WSASend connect ioctlsocket WSASocketW closesocket recv WSAIoctl getsockname WSAGetLastError getpeername getsockopt

bcrypt

BCryptGenRandom

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen strlen strcmp strcpy_s wcsncmp wcscmp

api-ms-win-crt-math-l1-1-0

trunc pow __setusermatherr floor roundf round fmod

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table abort _configure_narrow_argv _initterm _c_exit _cexit __p___argv _initterm_e exit __p___argc terminate _get_initial_narrow_environment _exit _register_onexit_function _register_thread_local_exe_atexit_callback _crt_atexit _seh_filter_exe _set_app_type _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free calloc _set_new_mode malloc _callnewh

Sharing

General

Malware Config

Signatures

File Explorer

hangar-installer.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

skybound-hangar-updater.exe

shell32

advapi32

kernel32

bcryptprimitives

ntdll

user32

comctl32

ole32

dwmapi

shlwapi

api-ms-win-core-synch-l1-2-0

combase

gdi32

imm32

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-l1-1-0

oleaut32

ws2_32

bcrypt

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic