Resubmissions
25-11-2020 10:45
201125-ekgtzqvpsn 825-11-2020 10:44
201125-hrpw21dsr6 825-11-2020 10:43
201125-wwx6w44c6j 8Analysis
-
max time kernel
57s -
max time network
34s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
25-11-2020 10:45
Static task
static1
Behavioral task
behavioral1
Sample
VitalInstaller.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
VitalInstaller.exe
Resource
win10v20201028
General
-
Target
VitalInstaller.exe
-
Size
23.6MB
-
MD5
e21bfcc2a8f2a46655bb7192858c7160
-
SHA1
33c9e1f6977d040bad6ec7ff52e2042a9e1ad976
-
SHA256
fa0698c6c51ff98d404bda2d90397aba8a03488cbe55fb62f1f02db7c63150b8
-
SHA512
c87e19708188b8dea23a6b073e8b2faa1deed78ec7d07fff844615dc89997e4d4d30cee4c2c8ea6c2fb1327e27badfe4846dc7e146238cb43879ff09c433a2e9
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
VitalInstaller.tmpvc_redist.x64.exevc_redist.x64.exepid process 2352 VitalInstaller.tmp 3124 vc_redist.x64.exe 3832 vc_redist.x64.exe -
Loads dropped DLL 1 IoCs
Processes:
vc_redist.x64.exepid process 3832 vc_redist.x64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
JavaScript code in executable 4 IoCs
Processes:
resource yara_rule C:\Program Files\Vital\stub\vc_redist.x64.exe js C:\Program Files\Vital\stub\vc_redist.x64.exe js C:\Windows\Temp\{7ED10270-65DD-4C8E-A8A7-E81C258530CB}\.cr\vc_redist.x64.exe js C:\Windows\Temp\{7ED10270-65DD-4C8E-A8A7-E81C258530CB}\.cr\vc_redist.x64.exe js -
Drops file in Program Files directory 12 IoCs
Processes:
VitalInstaller.tmpdescription ioc process File created C:\Program Files\Vital\stub\is-TRM5T.tmp VitalInstaller.tmp File created C:\Program Files\Vital\unins000.msg VitalInstaller.tmp File opened for modification C:\Program Files\Vital\unins000.dat VitalInstaller.tmp File opened for modification C:\Program Files\Vital\Vital.exe VitalInstaller.tmp File created C:\Program Files\Vital\is-4VUQL.tmp VitalInstaller.tmp File created C:\Program Files\Vital\unins000.dat VitalInstaller.tmp File created C:\Program Files\Vital\is-MQDBO.tmp VitalInstaller.tmp File created C:\Program Files\Common Files\VST3\is-9VN3E.tmp VitalInstaller.tmp File created C:\Program Files\Steinberg\VstPlugins\is-J9L55.tmp VitalInstaller.tmp File created C:\Program Files\Vital\is-5NP30.tmp VitalInstaller.tmp File opened for modification C:\Program Files\Steinberg\VstPlugins\Vital.dll VitalInstaller.tmp File opened for modification C:\Program Files\Vital\stub\vc_redist.x64.exe VitalInstaller.tmp -
Modifies registry class 10 IoCs
Processes:
VitalInstaller.tmpdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Vital\DefaultIcon\ = "C:\\Program Files\\Vital\\vital_icon.ico,0" VitalInstaller.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell\open\command VitalInstaller.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell\open VitalInstaller.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell\open\command\ = "\"C:\\Program Files\\Vital\\Vital.exe\" \"%1\"" VitalInstaller.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Vital VitalInstaller.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Vital\ = "Program Vital" VitalInstaller.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Vital\DefaultIcon VitalInstaller.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vital VitalInstaller.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vital\ = "Vital" VitalInstaller.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell VitalInstaller.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
VitalInstaller.tmppid process 2352 VitalInstaller.tmp 2352 VitalInstaller.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
VitalInstaller.tmppid process 2352 VitalInstaller.tmp -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
VitalInstaller.exevc_redist.x64.exedescription pid process target process PID 3268 wrote to memory of 2352 3268 VitalInstaller.exe VitalInstaller.tmp PID 3268 wrote to memory of 2352 3268 VitalInstaller.exe VitalInstaller.tmp PID 3268 wrote to memory of 2352 3268 VitalInstaller.exe VitalInstaller.tmp PID 3124 wrote to memory of 3832 3124 vc_redist.x64.exe vc_redist.x64.exe PID 3124 wrote to memory of 3832 3124 vc_redist.x64.exe vc_redist.x64.exe PID 3124 wrote to memory of 3832 3124 vc_redist.x64.exe vc_redist.x64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5DH04.tmp\VitalInstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-5DH04.tmp\VitalInstaller.tmp" /SL5="$20118,23804395,1039360,C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Vital\stub\vc_redist.x64.exe"C:\Program Files\Vital\stub\vc_redist.x64.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{7ED10270-65DD-4C8E-A8A7-E81C258530CB}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{7ED10270-65DD-4C8E-A8A7-E81C258530CB}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Vital\stub\vc_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=5922⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Vital\stub\vc_redist.x64.exeMD5
1e7bd6790391b5b710c6372ab2042351
SHA175f1aee6dccf3d6e6ac49926563737005b93ba13
SHA256952a0c6cb4a3dd14c3666ef05bb1982c5ff7f87b7103c2ba896354f00651e358
SHA512ae3860a060be483c9fcbcf6a41f561faf2cd681f39138dd13a563e3f39cf4b4f41e7c0f7b58bc8b585b2728245025be4b198f06634a97fa98847258272f9f59b
-
C:\Program Files\Vital\stub\vc_redist.x64.exeMD5
1e7bd6790391b5b710c6372ab2042351
SHA175f1aee6dccf3d6e6ac49926563737005b93ba13
SHA256952a0c6cb4a3dd14c3666ef05bb1982c5ff7f87b7103c2ba896354f00651e358
SHA512ae3860a060be483c9fcbcf6a41f561faf2cd681f39138dd13a563e3f39cf4b4f41e7c0f7b58bc8b585b2728245025be4b198f06634a97fa98847258272f9f59b
-
C:\Users\Admin\AppData\Local\Temp\is-5DH04.tmp\VitalInstaller.tmpMD5
1df3c250f6a5e4695da30f6b8b3900b6
SHA12debc282fd0b38de86f64dec8e5bcb3f331a5a04
SHA256074c90166f6fc80a231f51b7d37e4f23fe80f5db7d8fda177f7440b5f1bd3bd1
SHA51204bd95d531fa1ad1ee8cf92b2bd4f29cc2c4448288896f5ab5599f78a3ce7aa19085d4dad52bca2bf08c0bc23fc3c7e58bc82d507b7045e6473d833b61d59ce8
-
C:\Users\Admin\AppData\Local\Temp\is-5DH04.tmp\VitalInstaller.tmpMD5
1df3c250f6a5e4695da30f6b8b3900b6
SHA12debc282fd0b38de86f64dec8e5bcb3f331a5a04
SHA256074c90166f6fc80a231f51b7d37e4f23fe80f5db7d8fda177f7440b5f1bd3bd1
SHA51204bd95d531fa1ad1ee8cf92b2bd4f29cc2c4448288896f5ab5599f78a3ce7aa19085d4dad52bca2bf08c0bc23fc3c7e58bc82d507b7045e6473d833b61d59ce8
-
C:\Windows\Temp\{7ED10270-65DD-4C8E-A8A7-E81C258530CB}\.cr\vc_redist.x64.exeMD5
1d7599c4a31b82e70308c022e9494011
SHA17d04a03d5502df2838d40dd131b1cae226cb5205
SHA25621d2935d29c807a3a56c406849b97dbc7f720822920930d0e2b13a44203c107c
SHA512080ff020e0d2d9c0ce6beee8143c0f49e1b4450baa08072a8662f4b25ad6b034ee0ad174f2d4acd5b011cb8fb140656755007e245673f7677964b9e99555ab08
-
C:\Windows\Temp\{7ED10270-65DD-4C8E-A8A7-E81C258530CB}\.cr\vc_redist.x64.exeMD5
1d7599c4a31b82e70308c022e9494011
SHA17d04a03d5502df2838d40dd131b1cae226cb5205
SHA25621d2935d29c807a3a56c406849b97dbc7f720822920930d0e2b13a44203c107c
SHA512080ff020e0d2d9c0ce6beee8143c0f49e1b4450baa08072a8662f4b25ad6b034ee0ad174f2d4acd5b011cb8fb140656755007e245673f7677964b9e99555ab08
-
\Windows\Temp\{C9D357A7-B6A6-43E0-9C35-7F330F5DB9C2}\.ba\wixstdba.dllMD5
eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
memory/2352-0-0x0000000000000000-mapping.dmp
-
memory/3832-5-0x0000000000000000-mapping.dmp