60993129337e1a1f07964c4a34bee86292cd508e7a02d49ba1ca119fd02203f8

General

Target

aa7e600161d7614b3e08d40494f2d4bc.exe
Size

3.3MB
MD5

aa7e600161d7614b3e08d40494f2d4bc
SHA1

9d3780e0e0d6413711b2440cf6da6ce7cf79e1f2
SHA256

60993129337e1a1f07964c4a34bee86292cd508e7a02d49ba1ca119fd02203f8
SHA512

b3b14ac946177913539f36f4a1e137d59d82e596b91bcbbd1329405080ae181ae804423ba88087012405525db2665a93fc569a237884840c8e8854a5b61b524f

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 1 IoCs

Processes:

IntelRapid.exe

pid process

268 IntelRapid.exe

pid	process
268	IntelRapid.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

IntelRapid.exeaa7e600161d7614b3e08d40494f2d4bc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aa7e600161d7614b3e08d40494f2d4bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	aa7e600161d7614b3e08d40494f2d4bc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IntelRapid.exe

Drops startup file 1 IoCs

Processes:

aa7e600161d7614b3e08d40494f2d4bc.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk	aa7e600161d7614b3e08d40494f2d4bc.exe

Loads dropped DLL 3 IoCs

Processes:

aa7e600161d7614b3e08d40494f2d4bc.exe

pid process

880 aa7e600161d7614b3e08d40494f2d4bc.exe
880 aa7e600161d7614b3e08d40494f2d4bc.exe
880 aa7e600161d7614b3e08d40494f2d4bc.exe

pid	process
880	aa7e600161d7614b3e08d40494f2d4bc.exe
880	aa7e600161d7614b3e08d40494f2d4bc.exe
880	aa7e600161d7614b3e08d40494f2d4bc.exe

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/880-55-0x000000013FAD0000-0x00000001403EF000-memory.dmp	themida
behavioral1/memory/880-56-0x000000013FAD0000-0x00000001403EF000-memory.dmp	themida
behavioral1/memory/880-57-0x000000013FAD0000-0x00000001403EF000-memory.dmp	themida
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe	themida
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe	themida
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe	themida
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe	themida
behavioral1/memory/268-63-0x000000013F800000-0x000000014011F000-memory.dmp	themida
behavioral1/memory/268-64-0x000000013F800000-0x000000014011F000-memory.dmp	themida
behavioral1/memory/268-65-0x000000013F800000-0x000000014011F000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

aa7e600161d7614b3e08d40494f2d4bc.exeIntelRapid.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	aa7e600161d7614b3e08d40494f2d4bc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IntelRapid.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

aa7e600161d7614b3e08d40494f2d4bc.exeIntelRapid.exe

pid process

880 aa7e600161d7614b3e08d40494f2d4bc.exe
268 IntelRapid.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

IntelRapid.exe

pid process

268 IntelRapid.exe

pid	process
880	aa7e600161d7614b3e08d40494f2d4bc.exe
268	IntelRapid.exe

pid	process
268	IntelRapid.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

aa7e600161d7614b3e08d40494f2d4bc.exe

description	pid	process	target process
PID 880 wrote to memory of 268	880	aa7e600161d7614b3e08d40494f2d4bc.exe	IntelRapid.exe
PID 880 wrote to memory of 268	880	aa7e600161d7614b3e08d40494f2d4bc.exe	IntelRapid.exe
PID 880 wrote to memory of 268	880	aa7e600161d7614b3e08d40494f2d4bc.exe	IntelRapid.exe

C:\Users\Admin\AppData\Local\Temp\aa7e600161d7614b3e08d40494f2d4bc.exe
"C:\Users\Admin\AppData\Local\Temp\aa7e600161d7614b3e08d40494f2d4bc.exe"
1⤵
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:880

C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
PID:268

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
MD5
aa7e600161d7614b3e08d40494f2d4bc

SHA1
9d3780e0e0d6413711b2440cf6da6ce7cf79e1f2

SHA256
60993129337e1a1f07964c4a34bee86292cd508e7a02d49ba1ca119fd02203f8

SHA512
b3b14ac946177913539f36f4a1e137d59d82e596b91bcbbd1329405080ae181ae804423ba88087012405525db2665a93fc569a237884840c8e8854a5b61b524f

Download Submit
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
MD5
aa7e600161d7614b3e08d40494f2d4bc

SHA1
9d3780e0e0d6413711b2440cf6da6ce7cf79e1f2

SHA256
60993129337e1a1f07964c4a34bee86292cd508e7a02d49ba1ca119fd02203f8

SHA512
b3b14ac946177913539f36f4a1e137d59d82e596b91bcbbd1329405080ae181ae804423ba88087012405525db2665a93fc569a237884840c8e8854a5b61b524f

Download Submit
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
MD5
aa7e600161d7614b3e08d40494f2d4bc

SHA1
9d3780e0e0d6413711b2440cf6da6ce7cf79e1f2

SHA256
60993129337e1a1f07964c4a34bee86292cd508e7a02d49ba1ca119fd02203f8

SHA512
b3b14ac946177913539f36f4a1e137d59d82e596b91bcbbd1329405080ae181ae804423ba88087012405525db2665a93fc569a237884840c8e8854a5b61b524f

Download Submit
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
MD5
aa7e600161d7614b3e08d40494f2d4bc

SHA1
9d3780e0e0d6413711b2440cf6da6ce7cf79e1f2

SHA256
60993129337e1a1f07964c4a34bee86292cd508e7a02d49ba1ca119fd02203f8

SHA512
b3b14ac946177913539f36f4a1e137d59d82e596b91bcbbd1329405080ae181ae804423ba88087012405525db2665a93fc569a237884840c8e8854a5b61b524f

Download Submit
memory/268-63-0x000000013F800000-0x000000014011F000-memory.dmp

Filesize
9.1MB

Download
memory/268-64-0x000000013F800000-0x000000014011F000-memory.dmp

Filesize
9.1MB

Download
memory/268-65-0x000000013F800000-0x000000014011F000-memory.dmp

Filesize
9.1MB

Download
memory/880-55-0x000000013FAD0000-0x00000001403EF000-memory.dmp

Filesize
9.1MB

Download
memory/880-56-0x000000013FAD0000-0x00000001403EF000-memory.dmp

Filesize
9.1MB

Download
memory/880-57-0x000000013FAD0000-0x00000001403EF000-memory.dmp

Filesize
9.1MB

Download
memory/880-58-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads