Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-01-2022 14:27
Static task
static1
Behavioral task
behavioral1
Sample
IntelRapid.exe
Resource
win7-en-20211208
General
-
Target
IntelRapid.exe
-
Size
3.5MB
-
MD5
a9334eeb8615854db602db4447beeab2
-
SHA1
066ad5133b7435b75fe10d7af693c9b6811dc7a9
-
SHA256
d819e0689e1782f676e1644d503f31dae35589ea29b2b7169f69b81abea21d75
-
SHA512
a2f27c7716e2d7c2091a4f4a8b7fab7a9bd32d1640411cb9799756427b10468bc917963dab13c626d63fc6e0a081308779160f44a2987e68c250b41998d43b5c
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
IntelRapid.exepid process 1660 IntelRapid.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
IntelRapid.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe -
Drops startup file 1 IoCs
Processes:
IntelRapid.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk IntelRapid.exe -
Loads dropped DLL 3 IoCs
Processes:
IntelRapid.exepid process 1636 IntelRapid.exe 1636 IntelRapid.exe 1636 IntelRapid.exe -
Processes:
resource yara_rule behavioral1/memory/1636-54-0x000000013F9C0000-0x0000000140331000-memory.dmp themida behavioral1/memory/1636-55-0x000000013F9C0000-0x0000000140331000-memory.dmp themida behavioral1/memory/1636-56-0x000000013F9C0000-0x0000000140331000-memory.dmp themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida behavioral1/memory/1660-62-0x000000013FE50000-0x00000001407C1000-memory.dmp themida behavioral1/memory/1660-63-0x000000013FE50000-0x00000001407C1000-memory.dmp themida behavioral1/memory/1660-64-0x000000013FE50000-0x00000001407C1000-memory.dmp themida -
Processes:
IntelRapid.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
IntelRapid.exeIntelRapid.exepid process 1636 IntelRapid.exe 1660 IntelRapid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
IntelRapid.exepid process 1660 IntelRapid.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
IntelRapid.exedescription pid process target process PID 1636 wrote to memory of 1660 1636 IntelRapid.exe IntelRapid.exe PID 1636 wrote to memory of 1660 1636 IntelRapid.exe IntelRapid.exe PID 1636 wrote to memory of 1660 1636 IntelRapid.exe IntelRapid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IntelRapid.exe"C:\Users\Admin\AppData\Local\Temp\IntelRapid.exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
a9334eeb8615854db602db4447beeab2
SHA1066ad5133b7435b75fe10d7af693c9b6811dc7a9
SHA256d819e0689e1782f676e1644d503f31dae35589ea29b2b7169f69b81abea21d75
SHA512a2f27c7716e2d7c2091a4f4a8b7fab7a9bd32d1640411cb9799756427b10468bc917963dab13c626d63fc6e0a081308779160f44a2987e68c250b41998d43b5c
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
a9334eeb8615854db602db4447beeab2
SHA1066ad5133b7435b75fe10d7af693c9b6811dc7a9
SHA256d819e0689e1782f676e1644d503f31dae35589ea29b2b7169f69b81abea21d75
SHA512a2f27c7716e2d7c2091a4f4a8b7fab7a9bd32d1640411cb9799756427b10468bc917963dab13c626d63fc6e0a081308779160f44a2987e68c250b41998d43b5c
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
a9334eeb8615854db602db4447beeab2
SHA1066ad5133b7435b75fe10d7af693c9b6811dc7a9
SHA256d819e0689e1782f676e1644d503f31dae35589ea29b2b7169f69b81abea21d75
SHA512a2f27c7716e2d7c2091a4f4a8b7fab7a9bd32d1640411cb9799756427b10468bc917963dab13c626d63fc6e0a081308779160f44a2987e68c250b41998d43b5c
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
a9334eeb8615854db602db4447beeab2
SHA1066ad5133b7435b75fe10d7af693c9b6811dc7a9
SHA256d819e0689e1782f676e1644d503f31dae35589ea29b2b7169f69b81abea21d75
SHA512a2f27c7716e2d7c2091a4f4a8b7fab7a9bd32d1640411cb9799756427b10468bc917963dab13c626d63fc6e0a081308779160f44a2987e68c250b41998d43b5c
-
memory/1636-54-0x000000013F9C0000-0x0000000140331000-memory.dmpFilesize
9.4MB
-
memory/1636-55-0x000000013F9C0000-0x0000000140331000-memory.dmpFilesize
9.4MB
-
memory/1636-56-0x000000013F9C0000-0x0000000140331000-memory.dmpFilesize
9.4MB
-
memory/1636-57-0x000007FEFB8C1000-0x000007FEFB8C3000-memory.dmpFilesize
8KB
-
memory/1660-62-0x000000013FE50000-0x00000001407C1000-memory.dmpFilesize
9.4MB
-
memory/1660-63-0x000000013FE50000-0x00000001407C1000-memory.dmpFilesize
9.4MB
-
memory/1660-64-0x000000013FE50000-0x00000001407C1000-memory.dmpFilesize
9.4MB