fa0698c6c51ff98d404bda2d90397aba8a03488cbe55fb62f1f02db7c63150b8 | Triage

Resubmissions

25/11/2020, 10:45

201125-ekgtzqvpsn 8

25/11/2020, 10:44

201125-hrpw21dsr6 8

25/11/2020, 10:43

201125-wwx6w44c6j 8

Analysis

max time kernel
13s
max time network
14s
platform
windows10_x64
resource
win10v20201028
submitted
25/11/2020, 10:45

Sharing

Report Analysis Logs

General

Target

VitalInstaller.exe
Size

23.6MB
MD5

e21bfcc2a8f2a46655bb7192858c7160
SHA1

33c9e1f6977d040bad6ec7ff52e2042a9e1ad976
SHA256

fa0698c6c51ff98d404bda2d90397aba8a03488cbe55fb62f1f02db7c63150b8
SHA512

c87e19708188b8dea23a6b073e8b2faa1deed78ec7d07fff844615dc89997e4d4d30cee4c2c8ea6c2fb1327e27badfe4846dc7e146238cb43879ff09c433a2e9

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3344	VitalInstaller.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 3344	1628	VitalInstaller.exe	74
PID 1628 wrote to memory of 3344	1628	VitalInstaller.exe	74
PID 1628 wrote to memory of 3344	1628	VitalInstaller.exe	74

C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\is-H6RSG.tmp\VitalInstaller.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-H6RSG.tmp\VitalInstaller.tmp" /SL5="$201BE,23804395,1039360,C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"
  2⤵
  - Executes dropped EXE
  PID:3344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads