Resubmissions

25-11-2020 10:45

201125-ekgtzqvpsn 8

25-11-2020 10:44

201125-hrpw21dsr6 8

25-11-2020 10:43

201125-wwx6w44c6j 8

Analysis

  • max time kernel
    57s
  • max time network
    34s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    25-11-2020 10:45

General

  • Target

    VitalInstaller.exe

  • Size

    23.6MB

  • MD5

    e21bfcc2a8f2a46655bb7192858c7160

  • SHA1

    33c9e1f6977d040bad6ec7ff52e2042a9e1ad976

  • SHA256

    fa0698c6c51ff98d404bda2d90397aba8a03488cbe55fb62f1f02db7c63150b8

  • SHA512

    c87e19708188b8dea23a6b073e8b2faa1deed78ec7d07fff844615dc89997e4d4d30cee4c2c8ea6c2fb1327e27badfe4846dc7e146238cb43879ff09c433a2e9

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • JavaScript code in executable 4 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3268
    • C:\Users\Admin\AppData\Local\Temp\is-5DH04.tmp\VitalInstaller.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-5DH04.tmp\VitalInstaller.tmp" /SL5="$20118,23804395,1039360,C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:2352
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2668
    • C:\Program Files\Vital\stub\vc_redist.x64.exe
      "C:\Program Files\Vital\stub\vc_redist.x64.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3124
      • C:\Windows\Temp\{7ED10270-65DD-4C8E-A8A7-E81C258530CB}\.cr\vc_redist.x64.exe
        "C:\Windows\Temp\{7ED10270-65DD-4C8E-A8A7-E81C258530CB}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files\Vital\stub\vc_redist.x64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=592
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3832

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    1
    T1012

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Vital\stub\vc_redist.x64.exe
      MD5

      1e7bd6790391b5b710c6372ab2042351

      SHA1

      75f1aee6dccf3d6e6ac49926563737005b93ba13

      SHA256

      952a0c6cb4a3dd14c3666ef05bb1982c5ff7f87b7103c2ba896354f00651e358

      SHA512

      ae3860a060be483c9fcbcf6a41f561faf2cd681f39138dd13a563e3f39cf4b4f41e7c0f7b58bc8b585b2728245025be4b198f06634a97fa98847258272f9f59b

    • C:\Program Files\Vital\stub\vc_redist.x64.exe
      MD5

      1e7bd6790391b5b710c6372ab2042351

      SHA1

      75f1aee6dccf3d6e6ac49926563737005b93ba13

      SHA256

      952a0c6cb4a3dd14c3666ef05bb1982c5ff7f87b7103c2ba896354f00651e358

      SHA512

      ae3860a060be483c9fcbcf6a41f561faf2cd681f39138dd13a563e3f39cf4b4f41e7c0f7b58bc8b585b2728245025be4b198f06634a97fa98847258272f9f59b

    • C:\Users\Admin\AppData\Local\Temp\is-5DH04.tmp\VitalInstaller.tmp
      MD5

      1df3c250f6a5e4695da30f6b8b3900b6

      SHA1

      2debc282fd0b38de86f64dec8e5bcb3f331a5a04

      SHA256

      074c90166f6fc80a231f51b7d37e4f23fe80f5db7d8fda177f7440b5f1bd3bd1

      SHA512

      04bd95d531fa1ad1ee8cf92b2bd4f29cc2c4448288896f5ab5599f78a3ce7aa19085d4dad52bca2bf08c0bc23fc3c7e58bc82d507b7045e6473d833b61d59ce8

    • C:\Users\Admin\AppData\Local\Temp\is-5DH04.tmp\VitalInstaller.tmp
      MD5

      1df3c250f6a5e4695da30f6b8b3900b6

      SHA1

      2debc282fd0b38de86f64dec8e5bcb3f331a5a04

      SHA256

      074c90166f6fc80a231f51b7d37e4f23fe80f5db7d8fda177f7440b5f1bd3bd1

      SHA512

      04bd95d531fa1ad1ee8cf92b2bd4f29cc2c4448288896f5ab5599f78a3ce7aa19085d4dad52bca2bf08c0bc23fc3c7e58bc82d507b7045e6473d833b61d59ce8

    • C:\Windows\Temp\{7ED10270-65DD-4C8E-A8A7-E81C258530CB}\.cr\vc_redist.x64.exe
      MD5

      1d7599c4a31b82e70308c022e9494011

      SHA1

      7d04a03d5502df2838d40dd131b1cae226cb5205

      SHA256

      21d2935d29c807a3a56c406849b97dbc7f720822920930d0e2b13a44203c107c

      SHA512

      080ff020e0d2d9c0ce6beee8143c0f49e1b4450baa08072a8662f4b25ad6b034ee0ad174f2d4acd5b011cb8fb140656755007e245673f7677964b9e99555ab08

    • C:\Windows\Temp\{7ED10270-65DD-4C8E-A8A7-E81C258530CB}\.cr\vc_redist.x64.exe
      MD5

      1d7599c4a31b82e70308c022e9494011

      SHA1

      7d04a03d5502df2838d40dd131b1cae226cb5205

      SHA256

      21d2935d29c807a3a56c406849b97dbc7f720822920930d0e2b13a44203c107c

      SHA512

      080ff020e0d2d9c0ce6beee8143c0f49e1b4450baa08072a8662f4b25ad6b034ee0ad174f2d4acd5b011cb8fb140656755007e245673f7677964b9e99555ab08

    • \Windows\Temp\{C9D357A7-B6A6-43E0-9C35-7F330F5DB9C2}\.ba\wixstdba.dll
      MD5

      eab9caf4277829abdf6223ec1efa0edd

      SHA1

      74862ecf349a9bedd32699f2a7a4e00b4727543d

      SHA256

      a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

      SHA512

      45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

    • memory/2352-0-0x0000000000000000-mapping.dmp
    • memory/3832-5-0x0000000000000000-mapping.dmp