Resubmissions
25-11-2020 10:45
201125-ekgtzqvpsn 825-11-2020 10:44
201125-hrpw21dsr6 825-11-2020 10:43
201125-wwx6w44c6j 8Analysis
-
max time kernel
13s -
max time network
14s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
25-11-2020 10:45
Static task
static1
Behavioral task
behavioral1
Sample
VitalInstaller.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
VitalInstaller.exe
Resource
win10v20201028
General
-
Target
VitalInstaller.exe
-
Size
23.6MB
-
MD5
e21bfcc2a8f2a46655bb7192858c7160
-
SHA1
33c9e1f6977d040bad6ec7ff52e2042a9e1ad976
-
SHA256
fa0698c6c51ff98d404bda2d90397aba8a03488cbe55fb62f1f02db7c63150b8
-
SHA512
c87e19708188b8dea23a6b073e8b2faa1deed78ec7d07fff844615dc89997e4d4d30cee4c2c8ea6c2fb1327e27badfe4846dc7e146238cb43879ff09c433a2e9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
VitalInstaller.tmppid process 3344 VitalInstaller.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
VitalInstaller.exedescription pid process target process PID 1628 wrote to memory of 3344 1628 VitalInstaller.exe VitalInstaller.tmp PID 1628 wrote to memory of 3344 1628 VitalInstaller.exe VitalInstaller.tmp PID 1628 wrote to memory of 3344 1628 VitalInstaller.exe VitalInstaller.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H6RSG.tmp\VitalInstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-H6RSG.tmp\VitalInstaller.tmp" /SL5="$201BE,23804395,1039360,C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-H6RSG.tmp\VitalInstaller.tmpMD5
1df3c250f6a5e4695da30f6b8b3900b6
SHA12debc282fd0b38de86f64dec8e5bcb3f331a5a04
SHA256074c90166f6fc80a231f51b7d37e4f23fe80f5db7d8fda177f7440b5f1bd3bd1
SHA51204bd95d531fa1ad1ee8cf92b2bd4f29cc2c4448288896f5ab5599f78a3ce7aa19085d4dad52bca2bf08c0bc23fc3c7e58bc82d507b7045e6473d833b61d59ce8
-
memory/3344-0-0x0000000000000000-mapping.dmp