Resubmissions

25-11-2020 10:45

201125-ekgtzqvpsn 8

25-11-2020 10:44

201125-hrpw21dsr6 8

25-11-2020 10:43

201125-wwx6w44c6j 8

Analysis

  • max time kernel
    13s
  • max time network
    14s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    25-11-2020 10:45

General

  • Target

    VitalInstaller.exe

  • Size

    23.6MB

  • MD5

    e21bfcc2a8f2a46655bb7192858c7160

  • SHA1

    33c9e1f6977d040bad6ec7ff52e2042a9e1ad976

  • SHA256

    fa0698c6c51ff98d404bda2d90397aba8a03488cbe55fb62f1f02db7c63150b8

  • SHA512

    c87e19708188b8dea23a6b073e8b2faa1deed78ec7d07fff844615dc89997e4d4d30cee4c2c8ea6c2fb1327e27badfe4846dc7e146238cb43879ff09c433a2e9

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Users\Admin\AppData\Local\Temp\is-H6RSG.tmp\VitalInstaller.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-H6RSG.tmp\VitalInstaller.tmp" /SL5="$201BE,23804395,1039360,C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"
      2⤵
      • Executes dropped EXE
      PID:3344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-H6RSG.tmp\VitalInstaller.tmp
    MD5

    1df3c250f6a5e4695da30f6b8b3900b6

    SHA1

    2debc282fd0b38de86f64dec8e5bcb3f331a5a04

    SHA256

    074c90166f6fc80a231f51b7d37e4f23fe80f5db7d8fda177f7440b5f1bd3bd1

    SHA512

    04bd95d531fa1ad1ee8cf92b2bd4f29cc2c4448288896f5ab5599f78a3ce7aa19085d4dad52bca2bf08c0bc23fc3c7e58bc82d507b7045e6473d833b61d59ce8

  • memory/3344-0-0x0000000000000000-mapping.dmp