fa0698c6c51ff98d404bda2d90397aba8a03488cbe55fb62f1f02db7c63150b8

Resubmissions

25/11/2020, 10:45

201125-ekgtzqvpsn 8

25/11/2020, 10:44

201125-hrpw21dsr6 8

25/11/2020, 10:43

201125-wwx6w44c6j 8

Analysis

max time kernel
57s
max time network
34s
platform
windows10_x64
resource
win10v20201028
submitted
25/11/2020, 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VitalInstaller.exe
Size

23.6MB
MD5

e21bfcc2a8f2a46655bb7192858c7160
SHA1

33c9e1f6977d040bad6ec7ff52e2042a9e1ad976
SHA256

fa0698c6c51ff98d404bda2d90397aba8a03488cbe55fb62f1f02db7c63150b8
SHA512

c87e19708188b8dea23a6b073e8b2faa1deed78ec7d07fff844615dc89997e4d4d30cee4c2c8ea6c2fb1327e27badfe4846dc7e146238cb43879ff09c433a2e9

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2352	VitalInstaller.tmp
3124	vc_redist.x64.exe
3832	vc_redist.x64.exe

Loads dropped DLL 1 IoCs

pid	Process
3832	vc_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

JavaScript code in executable 4 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ab75-3.dat	js
behavioral2/files/0x000100000001ab75-4.dat	js
behavioral2/files/0x000200000001a59e-6.dat	js
behavioral2/files/0x000200000001a59e-7.dat	js

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Vital\stub\is-TRM5T.tmp	VitalInstaller.tmp
File created	C:\Program Files\Vital\unins000.msg	VitalInstaller.tmp
File opened for modification	C:\Program Files\Vital\unins000.dat	VitalInstaller.tmp
File opened for modification	C:\Program Files\Vital\Vital.exe	VitalInstaller.tmp
File created	C:\Program Files\Vital\is-4VUQL.tmp	VitalInstaller.tmp
File created	C:\Program Files\Vital\unins000.dat	VitalInstaller.tmp
File created	C:\Program Files\Vital\is-MQDBO.tmp	VitalInstaller.tmp
File created	C:\Program Files\Common Files\VST3\is-9VN3E.tmp	VitalInstaller.tmp
File created	C:\Program Files\Steinberg\VstPlugins\is-J9L55.tmp	VitalInstaller.tmp
File created	C:\Program Files\Vital\is-5NP30.tmp	VitalInstaller.tmp
File opened for modification	C:\Program Files\Steinberg\VstPlugins\Vital.dll	VitalInstaller.tmp
File opened for modification	C:\Program Files\Vital\stub\vc_redist.x64.exe	VitalInstaller.tmp

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\DefaultIcon\ = "C:\\Program Files\\Vital\\vital_icon.ico,0"	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell\open\command	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell\open	VitalInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell\open\command\ = "\"C:\\Program Files\\Vital\\Vital.exe\" \"%1\""	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital	VitalInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\ = "Program Vital"	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\DefaultIcon	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vital	VitalInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vital\ = "Vital"	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell	VitalInstaller.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2352	VitalInstaller.tmp
2352	VitalInstaller.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	VitalInstaller.tmp

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 2352	3268	VitalInstaller.exe	75
PID 3268 wrote to memory of 2352	3268	VitalInstaller.exe	75
PID 3268 wrote to memory of 2352	3268	VitalInstaller.exe	75
PID 3124 wrote to memory of 3832	3124	vc_redist.x64.exe	86
PID 3124 wrote to memory of 3832	3124	vc_redist.x64.exe	86
PID 3124 wrote to memory of 3832	3124	vc_redist.x64.exe	86

C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Users\Admin\AppData\Local\Temp\is-5DH04.tmp\VitalInstaller.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-5DH04.tmp\VitalInstaller.tmp" /SL5="$20118,23804395,1039360,C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:2352

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2668

C:\Program Files\Vital\stub\vc_redist.x64.exe
"C:\Program Files\Vital\stub\vc_redist.x64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\Temp\{7ED10270-65DD-4C8E-A8A7-E81C258530CB}\.cr\vc_redist.x64.exe
  "C:\Windows\Temp\{7ED10270-65DD-4C8E-A8A7-E81C258530CB}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Vital\stub\vc_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=592
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads