Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
16-01-2022 08:15
Static task
static1
Behavioral task
behavioral1
Sample
978b7f1dba9746c29ac4b61bc219bd7b.exe
Resource
win7-en-20211208
General
-
Target
978b7f1dba9746c29ac4b61bc219bd7b.exe
-
Size
3.2MB
-
MD5
978b7f1dba9746c29ac4b61bc219bd7b
-
SHA1
f498e5ebf211bace3e027a1596edfdcf7900317c
-
SHA256
e36e717ad1f661f695e905d457dba6729aa238c0da051893ebec1429e042ddf7
-
SHA512
dbdba57e4af16966d814bb0fafec867be05dd33381ab3140cb99249a7df57f7a09f69bdec5909d00a7268fda7574be3e738561bf094b211e3e9d5c6fb126da08
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
IntelRapid.exepid process 812 IntelRapid.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
978b7f1dba9746c29ac4b61bc219bd7b.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 978b7f1dba9746c29ac4b61bc219bd7b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 978b7f1dba9746c29ac4b61bc219bd7b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe -
Drops startup file 1 IoCs
Processes:
978b7f1dba9746c29ac4b61bc219bd7b.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk 978b7f1dba9746c29ac4b61bc219bd7b.exe -
Loads dropped DLL 3 IoCs
Processes:
978b7f1dba9746c29ac4b61bc219bd7b.exepid process 1652 978b7f1dba9746c29ac4b61bc219bd7b.exe 1652 978b7f1dba9746c29ac4b61bc219bd7b.exe 1652 978b7f1dba9746c29ac4b61bc219bd7b.exe -
Processes:
resource yara_rule behavioral1/memory/1652-55-0x000000013F350000-0x000000013FC51000-memory.dmp themida behavioral1/memory/1652-56-0x000000013F350000-0x000000013FC51000-memory.dmp themida behavioral1/memory/1652-57-0x000000013F350000-0x000000013FC51000-memory.dmp themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida behavioral1/memory/812-64-0x000000013F240000-0x000000013FB41000-memory.dmp themida behavioral1/memory/812-65-0x000000013F240000-0x000000013FB41000-memory.dmp themida behavioral1/memory/812-66-0x000000013F240000-0x000000013FB41000-memory.dmp themida -
Processes:
IntelRapid.exe978b7f1dba9746c29ac4b61bc219bd7b.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 978b7f1dba9746c29ac4b61bc219bd7b.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
978b7f1dba9746c29ac4b61bc219bd7b.exeIntelRapid.exepid process 1652 978b7f1dba9746c29ac4b61bc219bd7b.exe 812 IntelRapid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
IntelRapid.exepid process 812 IntelRapid.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
978b7f1dba9746c29ac4b61bc219bd7b.exedescription pid process target process PID 1652 wrote to memory of 812 1652 978b7f1dba9746c29ac4b61bc219bd7b.exe IntelRapid.exe PID 1652 wrote to memory of 812 1652 978b7f1dba9746c29ac4b61bc219bd7b.exe IntelRapid.exe PID 1652 wrote to memory of 812 1652 978b7f1dba9746c29ac4b61bc219bd7b.exe IntelRapid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\978b7f1dba9746c29ac4b61bc219bd7b.exe"C:\Users\Admin\AppData\Local\Temp\978b7f1dba9746c29ac4b61bc219bd7b.exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
978b7f1dba9746c29ac4b61bc219bd7b
SHA1f498e5ebf211bace3e027a1596edfdcf7900317c
SHA256e36e717ad1f661f695e905d457dba6729aa238c0da051893ebec1429e042ddf7
SHA512dbdba57e4af16966d814bb0fafec867be05dd33381ab3140cb99249a7df57f7a09f69bdec5909d00a7268fda7574be3e738561bf094b211e3e9d5c6fb126da08
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
978b7f1dba9746c29ac4b61bc219bd7b
SHA1f498e5ebf211bace3e027a1596edfdcf7900317c
SHA256e36e717ad1f661f695e905d457dba6729aa238c0da051893ebec1429e042ddf7
SHA512dbdba57e4af16966d814bb0fafec867be05dd33381ab3140cb99249a7df57f7a09f69bdec5909d00a7268fda7574be3e738561bf094b211e3e9d5c6fb126da08
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
978b7f1dba9746c29ac4b61bc219bd7b
SHA1f498e5ebf211bace3e027a1596edfdcf7900317c
SHA256e36e717ad1f661f695e905d457dba6729aa238c0da051893ebec1429e042ddf7
SHA512dbdba57e4af16966d814bb0fafec867be05dd33381ab3140cb99249a7df57f7a09f69bdec5909d00a7268fda7574be3e738561bf094b211e3e9d5c6fb126da08
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
978b7f1dba9746c29ac4b61bc219bd7b
SHA1f498e5ebf211bace3e027a1596edfdcf7900317c
SHA256e36e717ad1f661f695e905d457dba6729aa238c0da051893ebec1429e042ddf7
SHA512dbdba57e4af16966d814bb0fafec867be05dd33381ab3140cb99249a7df57f7a09f69bdec5909d00a7268fda7574be3e738561bf094b211e3e9d5c6fb126da08
-
memory/812-62-0x0000000000000000-mapping.dmp
-
memory/812-64-0x000000013F240000-0x000000013FB41000-memory.dmpFilesize
9.0MB
-
memory/812-65-0x000000013F240000-0x000000013FB41000-memory.dmpFilesize
9.0MB
-
memory/812-66-0x000000013F240000-0x000000013FB41000-memory.dmpFilesize
9.0MB
-
memory/1652-55-0x000000013F350000-0x000000013FC51000-memory.dmpFilesize
9.0MB
-
memory/1652-56-0x000000013F350000-0x000000013FC51000-memory.dmpFilesize
9.0MB
-
memory/1652-57-0x000000013F350000-0x000000013FC51000-memory.dmpFilesize
9.0MB
-
memory/1652-58-0x000007FEFB631000-0x000007FEFB633000-memory.dmpFilesize
8KB