VantaLoader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VantaLoader.exe
Size 114.1MB
Sample261029-11kf2sttay
SHA256 986c949e7ce2fada8896ad2391c3b4d9022ebf84b90514e4f4a98f2c49696538
MD5 676e7c43a76988571d59f7c6d87b0684
SHA1 02be9b3097fb346c2b4c6d01d358e0ca73ddaaf6
SHA512 dc29f760a88935af75957420a89942c1b8b24467e5b53421d897737203a1d892556ea612ad2b4c60521a16d78df61dfc10505c2bfd245abec3dab02fe21ddb29
SSDEEP 1572864:WDYrjPn6pwZMVcmsbVak3CmcDO/neFilv03zm8b4WxAF36ADmuPVSxEQzrET:WDOCpwuVybVa2rxlv0zm8bBpkWEgrE
TLSH
T199480216B79842B9C07BE27D8B8B5A13F772B00A13716BEB01E409651F67BE05E3F650
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VantaLoader.exe

File Explorer

VantaLoader.exe

.exe 114.1MB

VantaLoader.exe

IMPHASH d5d16528d5aeb393517f0eabbd973059
SHA256 986c949e7ce2fada8896ad2391c3b4d9022ebf84b90514e4f4a98f2c49696538
MD5 676e7c43a76988571d59f7c6d87b0684
SHA1 02be9b3097fb346c2b4c6d01d358e0ca73ddaaf6
SHA512 dc29f760a88935af75957420a89942c1b8b24467e5b53421d897737203a1d892556ea612ad2b4c60521a16d78df61dfc10505c2bfd245abec3dab02fe21ddb29
SSDEEP 1572864:WDYrjPn6pwZMVcmsbVak3CmcDO/neFilv03zm8b4WxAF36ADmuPVSxEQzrET:WDOCpwuVybVa2rxlv0zm8bBpkWEgrE
TLSH
T199480216B79842B9C07BE27D8B8B5A13F772B00A13716BEB01E409651F67BE05E3F650
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

701840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

ReleaseCapture SystemParametersInfoW PostQuitMessage PostThreadMessageW GetClientRect SetWindowsHookExW LoadCursorW LoadIconW TranslateMessage SetLayeredWindowAttributes EnumWindows UnhookWindowsHookEx GetForegroundWindow RegisterClassW PeekMessageW ClientToScreen InvalidateRect BeginPaint GetAsyncKeyState IsWindow EndPaint ShowWindow GetWindowLongPtrW CallNextHookEx SendMessageW CreateWindowExW FillRect SetWindowLongPtrW GetDpiForWindow MessageBoxW SetWindowPos IsWindowVisible DestroyWindow GetDpiForSystem SetTimer GetWindowRect SetProcessDpiAwarenessContext MapVirtualKeyW PostMessageW IsIconic DispatchMessageW SendInput DefWindowProcW GetWindowThreadProcessId GetMessageW

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC PatBlt CreateFontW GetStockObject DeleteDC TextOutW GetTextExtentPoint32W SetTextColor SetBkMode LineTo CreatePen MoveToEx Ellipse DeleteObject CreateSolidBrush

shell32

CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shlwapi

ord12

advapi32

EventWriteTransfer RegOpenKeyExW RegCloseKey RegGetValueW EventUnregister EventRegister EventSetInformation RegQueryValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGetProperty BCryptDestroyKey BCryptCreateHash BCryptDestroyHash BCryptSetProperty BCryptHashData BCryptGenRandom

crypt32

CryptBinaryToStringA CryptUnprotectData CryptProtectData CryptStringToBinaryA

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable

dxgi

CreateDXGIFactory1

d3d12

ord101

dwmapi

DwmSetWindowAttribute

winmm

joyGetPosEx joyGetNumDevs joyGetDevCapsW timeBeginPeriod timeEndPeriod

kernel32

UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent WriteConsoleW GetFileType GetStdHandle GetModuleHandleExW SetFilePointerEx HeapAlloc GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileSizeEx FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError ReadFile ReadConsoleW IsValidCodePage RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW InitializeSListHead GetCurrentProcessId SetEnvironmentVariableW SetStdHandle HeapSize SetEndOfFile QueryFullProcessImageNameW GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW WakeAllConditionVariable GetCPInfo CompareStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection LCMapStringEx GetExitCodeThread WaitForSingleObjectEx Sleep SleepConditionVariableSRW SizeofResource SetDefaultDllDirectories AddDllDirectory GetCommandLineW GetCurrentThreadId OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetLastError Process32NextW LockResource Process32FirstW CloseHandle LoadResource FindResourceW GetProcAddress LocalFree MoveFileExW ReadProcessMemory SystemTimeToFileTime GetModuleHandleW FreeLibrary WideCharToMultiByte RtlUnwind GetSystemTimeAsFileTime K32EnumProcessModules GetSystemTime GetProcessTimes LoadLibraryExW VirtualQueryEx GetExitCodeProcess GetFileAttributesW CreateFileW OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetProcessHeap HeapFree LoadLibraryW GetEnvironmentVariableW FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 AreFileApisANSI CopyFile2 GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive

Name

.text

Size

921KB

Virtual Size

921KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

203KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

112.9MB

Virtual Size

112.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

VantaLoader.exe

user32

gdi32

shell32

ole32

shlwapi

advapi32

bcrypt

crypt32

winhttp

dxgi

d3d12

dwmapi

winmm

kernel32

generic