Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-01-2022 08:14
Static task
static1
Behavioral task
behavioral1
Sample
a997db4429053e504cd9d4afaab825cd.exe
Resource
win7-en-20211208
General
-
Target
a997db4429053e504cd9d4afaab825cd.exe
-
Size
3.3MB
-
MD5
a997db4429053e504cd9d4afaab825cd
-
SHA1
c0f15b9aaf8876619b9dbe08e429a024d646b867
-
SHA256
dca68095317df735cbaac8724a3d4af4aa504d1b58e30699388b67ec44a0e5b8
-
SHA512
84bf29ec7b74577c801507d2f08de15b64d3940650067f12a9433924305fa4741593e08b91cb75100c39590f769a9c63b7c3d14faaf9c8d675de35b1a7636117
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
IntelRapid.exepid process 664 IntelRapid.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
a997db4429053e504cd9d4afaab825cd.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a997db4429053e504cd9d4afaab825cd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a997db4429053e504cd9d4afaab825cd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe -
Drops startup file 1 IoCs
Processes:
a997db4429053e504cd9d4afaab825cd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk a997db4429053e504cd9d4afaab825cd.exe -
Loads dropped DLL 3 IoCs
Processes:
a997db4429053e504cd9d4afaab825cd.exepid process 944 a997db4429053e504cd9d4afaab825cd.exe 944 a997db4429053e504cd9d4afaab825cd.exe 944 a997db4429053e504cd9d4afaab825cd.exe -
Processes:
resource yara_rule behavioral1/memory/944-55-0x000000013F4E0000-0x000000013FDFA000-memory.dmp themida behavioral1/memory/944-56-0x000000013F4E0000-0x000000013FDFA000-memory.dmp themida behavioral1/memory/944-57-0x000000013F4E0000-0x000000013FDFA000-memory.dmp themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida behavioral1/memory/664-63-0x000000013FAC0000-0x00000001403DA000-memory.dmp themida behavioral1/memory/664-64-0x000000013FAC0000-0x00000001403DA000-memory.dmp themida behavioral1/memory/664-65-0x000000013FAC0000-0x00000001403DA000-memory.dmp themida -
Processes:
a997db4429053e504cd9d4afaab825cd.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a997db4429053e504cd9d4afaab825cd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
a997db4429053e504cd9d4afaab825cd.exeIntelRapid.exepid process 944 a997db4429053e504cd9d4afaab825cd.exe 664 IntelRapid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
IntelRapid.exepid process 664 IntelRapid.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a997db4429053e504cd9d4afaab825cd.exedescription pid process target process PID 944 wrote to memory of 664 944 a997db4429053e504cd9d4afaab825cd.exe IntelRapid.exe PID 944 wrote to memory of 664 944 a997db4429053e504cd9d4afaab825cd.exe IntelRapid.exe PID 944 wrote to memory of 664 944 a997db4429053e504cd9d4afaab825cd.exe IntelRapid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a997db4429053e504cd9d4afaab825cd.exe"C:\Users\Admin\AppData\Local\Temp\a997db4429053e504cd9d4afaab825cd.exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
a997db4429053e504cd9d4afaab825cd
SHA1c0f15b9aaf8876619b9dbe08e429a024d646b867
SHA256dca68095317df735cbaac8724a3d4af4aa504d1b58e30699388b67ec44a0e5b8
SHA51284bf29ec7b74577c801507d2f08de15b64d3940650067f12a9433924305fa4741593e08b91cb75100c39590f769a9c63b7c3d14faaf9c8d675de35b1a7636117
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
a997db4429053e504cd9d4afaab825cd
SHA1c0f15b9aaf8876619b9dbe08e429a024d646b867
SHA256dca68095317df735cbaac8724a3d4af4aa504d1b58e30699388b67ec44a0e5b8
SHA51284bf29ec7b74577c801507d2f08de15b64d3940650067f12a9433924305fa4741593e08b91cb75100c39590f769a9c63b7c3d14faaf9c8d675de35b1a7636117
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
a997db4429053e504cd9d4afaab825cd
SHA1c0f15b9aaf8876619b9dbe08e429a024d646b867
SHA256dca68095317df735cbaac8724a3d4af4aa504d1b58e30699388b67ec44a0e5b8
SHA51284bf29ec7b74577c801507d2f08de15b64d3940650067f12a9433924305fa4741593e08b91cb75100c39590f769a9c63b7c3d14faaf9c8d675de35b1a7636117
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
a997db4429053e504cd9d4afaab825cd
SHA1c0f15b9aaf8876619b9dbe08e429a024d646b867
SHA256dca68095317df735cbaac8724a3d4af4aa504d1b58e30699388b67ec44a0e5b8
SHA51284bf29ec7b74577c801507d2f08de15b64d3940650067f12a9433924305fa4741593e08b91cb75100c39590f769a9c63b7c3d14faaf9c8d675de35b1a7636117
-
memory/664-63-0x000000013FAC0000-0x00000001403DA000-memory.dmpFilesize
9.1MB
-
memory/664-64-0x000000013FAC0000-0x00000001403DA000-memory.dmpFilesize
9.1MB
-
memory/664-65-0x000000013FAC0000-0x00000001403DA000-memory.dmpFilesize
9.1MB
-
memory/944-55-0x000000013F4E0000-0x000000013FDFA000-memory.dmpFilesize
9.1MB
-
memory/944-56-0x000000013F4E0000-0x000000013FDFA000-memory.dmpFilesize
9.1MB
-
memory/944-57-0x000000013F4E0000-0x000000013FDFA000-memory.dmpFilesize
9.1MB
-
memory/944-58-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmpFilesize
8KB