fa0698c6c51ff98d404bda2d90397aba8a03488cbe55fb62f1f02db7c63150b8

Resubmissions

25-11-2020 10:45

201125-ekgtzqvpsn 8

25-11-2020 10:44

201125-hrpw21dsr6 8

25-11-2020 10:43

201125-wwx6w44c6j 8

Analysis

max time kernel
35s
max time network
15s
platform
windows10_x64
resource
win10v20201028
submitted
25-11-2020 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VitalInstaller.exe
Size

23.6MB
MD5

e21bfcc2a8f2a46655bb7192858c7160
SHA1

33c9e1f6977d040bad6ec7ff52e2042a9e1ad976
SHA256

fa0698c6c51ff98d404bda2d90397aba8a03488cbe55fb62f1f02db7c63150b8
SHA512

c87e19708188b8dea23a6b073e8b2faa1deed78ec7d07fff844615dc89997e4d4d30cee4c2c8ea6c2fb1327e27badfe4846dc7e146238cb43879ff09c433a2e9

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

VitalInstaller.tmp

pid process

2492 VitalInstaller.tmp
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2492	VitalInstaller.tmp

Drops file in Program Files directory 12 IoCs

Processes:

VitalInstaller.tmp

description	ioc	process
File created	C:\Program Files\Vital\is-P90SJ.tmp	VitalInstaller.tmp
File created	C:\Program Files\Common Files\VST3\is-KCNQE.tmp	VitalInstaller.tmp
File created	C:\Program Files\Vital\stub\is-BBIJI.tmp	VitalInstaller.tmp
File opened for modification	C:\Program Files\Vital\unins000.dat	VitalInstaller.tmp
File opened for modification	C:\Program Files\Vital\stub\vc_redist.x64.exe	VitalInstaller.tmp
File created	C:\Program Files\Vital\unins000.dat	VitalInstaller.tmp
File created	C:\Program Files\Vital\is-KTQIR.tmp	VitalInstaller.tmp
File created	C:\Program Files\Steinberg\VstPlugins\is-KQ1PI.tmp	VitalInstaller.tmp
File created	C:\Program Files\Vital\is-3K9CN.tmp	VitalInstaller.tmp
File created	C:\Program Files\Vital\unins000.msg	VitalInstaller.tmp
File opened for modification	C:\Program Files\Vital\Vital.exe	VitalInstaller.tmp
File opened for modification	C:\Program Files\Steinberg\VstPlugins\Vital.dll	VitalInstaller.tmp

Modifies registry class 10 IoCs

Processes:

VitalInstaller.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell\open	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vital	VitalInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vital\ = "Vital"	VitalInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\ = "Program Vital"	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\DefaultIcon	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell\open\command	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital	VitalInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\DefaultIcon\ = "C:\\Program Files\\Vital\\vital_icon.ico,0"	VitalInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell\open\command\ = "\"C:\\Program Files\\Vital\\Vital.exe\" \"%1\""	VitalInstaller.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

VitalInstaller.tmp

pid process

2492 VitalInstaller.tmp
2492 VitalInstaller.tmp
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

VitalInstaller.tmp

pid process

2492 VitalInstaller.tmp

pid	process
2492	VitalInstaller.tmp
2492	VitalInstaller.tmp

pid	process
2492	VitalInstaller.tmp

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

VitalInstaller.exe

description	pid	process	target process
PID 1056 wrote to memory of 2492	1056	VitalInstaller.exe	VitalInstaller.tmp
PID 1056 wrote to memory of 2492	1056	VitalInstaller.exe	VitalInstaller.tmp
PID 1056 wrote to memory of 2492	1056	VitalInstaller.exe	VitalInstaller.tmp

C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Users\Admin\AppData\Local\Temp\is-Q1NOA.tmp\VitalInstaller.tmp
"C:\Users\Admin\AppData\Local\Temp\is-Q1NOA.tmp\VitalInstaller.tmp" /SL5="$2011E,23804395,1039360,C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3776

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-Q1NOA.tmp\VitalInstaller.tmp
MD5
1df3c250f6a5e4695da30f6b8b3900b6

SHA1
2debc282fd0b38de86f64dec8e5bcb3f331a5a04

SHA256
074c90166f6fc80a231f51b7d37e4f23fe80f5db7d8fda177f7440b5f1bd3bd1

SHA512
04bd95d531fa1ad1ee8cf92b2bd4f29cc2c4448288896f5ab5599f78a3ce7aa19085d4dad52bca2bf08c0bc23fc3c7e58bc82d507b7045e6473d833b61d59ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q1NOA.tmp\VitalInstaller.tmp
MD5
1df3c250f6a5e4695da30f6b8b3900b6

SHA1
2debc282fd0b38de86f64dec8e5bcb3f331a5a04

SHA256
074c90166f6fc80a231f51b7d37e4f23fe80f5db7d8fda177f7440b5f1bd3bd1

SHA512
04bd95d531fa1ad1ee8cf92b2bd4f29cc2c4448288896f5ab5599f78a3ce7aa19085d4dad52bca2bf08c0bc23fc3c7e58bc82d507b7045e6473d833b61d59ce8

Download Submit
memory/2492-0-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads