fa0698c6c51ff98d404bda2d90397aba8a03488cbe55fb62f1f02db7c63150b8

Resubmissions

25/11/2020, 10:45

201125-ekgtzqvpsn 8

25/11/2020, 10:44

201125-hrpw21dsr6 8

25/11/2020, 10:43

201125-wwx6w44c6j 8

Analysis

max time kernel
35s
max time network
15s
platform
windows10_x64
resource
win10v20201028
submitted
25/11/2020, 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VitalInstaller.exe
Size

23.6MB
MD5

e21bfcc2a8f2a46655bb7192858c7160
SHA1

33c9e1f6977d040bad6ec7ff52e2042a9e1ad976
SHA256

fa0698c6c51ff98d404bda2d90397aba8a03488cbe55fb62f1f02db7c63150b8
SHA512

c87e19708188b8dea23a6b073e8b2faa1deed78ec7d07fff844615dc89997e4d4d30cee4c2c8ea6c2fb1327e27badfe4846dc7e146238cb43879ff09c433a2e9

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2492	VitalInstaller.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files\Vital\is-P90SJ.tmp	VitalInstaller.tmp
File created	C:\Program Files\Common Files\VST3\is-KCNQE.tmp	VitalInstaller.tmp
File created	C:\Program Files\Vital\stub\is-BBIJI.tmp	VitalInstaller.tmp
File opened for modification	C:\Program Files\Vital\unins000.dat	VitalInstaller.tmp
File opened for modification	C:\Program Files\Vital\stub\vc_redist.x64.exe	VitalInstaller.tmp
File created	C:\Program Files\Vital\unins000.dat	VitalInstaller.tmp
File created	C:\Program Files\Vital\is-KTQIR.tmp	VitalInstaller.tmp
File created	C:\Program Files\Steinberg\VstPlugins\is-KQ1PI.tmp	VitalInstaller.tmp
File created	C:\Program Files\Vital\is-3K9CN.tmp	VitalInstaller.tmp
File created	C:\Program Files\Vital\unins000.msg	VitalInstaller.tmp
File opened for modification	C:\Program Files\Vital\Vital.exe	VitalInstaller.tmp
File opened for modification	C:\Program Files\Steinberg\VstPlugins\Vital.dll	VitalInstaller.tmp

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell\open	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vital	VitalInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vital\ = "Vital"	VitalInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\ = "Program Vital"	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\DefaultIcon	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell\open\command	VitalInstaller.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital	VitalInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\DefaultIcon\ = "C:\\Program Files\\Vital\\vital_icon.ico,0"	VitalInstaller.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vital\shell\open\command\ = "\"C:\\Program Files\\Vital\\Vital.exe\" \"%1\""	VitalInstaller.tmp

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2492	VitalInstaller.tmp
2492	VitalInstaller.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2492	VitalInstaller.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2492	1056	VitalInstaller.exe	76
PID 1056 wrote to memory of 2492	1056	VitalInstaller.exe	76
PID 1056 wrote to memory of 2492	1056	VitalInstaller.exe	76

C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\is-Q1NOA.tmp\VitalInstaller.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-Q1NOA.tmp\VitalInstaller.tmp" /SL5="$2011E,23804395,1039360,C:\Users\Admin\AppData\Local\Temp\VitalInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:2492

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads