Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-01-2022 19:50
Static task
static1
Behavioral task
behavioral1
Sample
6b73040840cf675d89f95e643476ce10.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6b73040840cf675d89f95e643476ce10.exe
Resource
win10v2004-en-20220112
General
-
Target
6b73040840cf675d89f95e643476ce10.exe
-
Size
3.4MB
-
MD5
6b73040840cf675d89f95e643476ce10
-
SHA1
04b5c30cdb12d2f271e7111bb1e3b7f25927642b
-
SHA256
3a650900dde9c97d1c23110b2b04ba2c5d861e48f05d894d1022e8875361869b
-
SHA512
041a0ff85149de77e5a1a0fd3c6f140ce93b5a8328b3390ac12d95abca4e5f437d7d6b4954b9585cdb5e4ac93d790782e06f02c637e64f33e892104efd9a8db5
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
IntelRapid.exepid process 464 IntelRapid.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
6b73040840cf675d89f95e643476ce10.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6b73040840cf675d89f95e643476ce10.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6b73040840cf675d89f95e643476ce10.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe -
Drops startup file 1 IoCs
Processes:
6b73040840cf675d89f95e643476ce10.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk 6b73040840cf675d89f95e643476ce10.exe -
Loads dropped DLL 3 IoCs
Processes:
6b73040840cf675d89f95e643476ce10.exepid process 1400 6b73040840cf675d89f95e643476ce10.exe 1400 6b73040840cf675d89f95e643476ce10.exe 1400 6b73040840cf675d89f95e643476ce10.exe -
Processes:
resource yara_rule behavioral1/memory/1400-53-0x000000013FC10000-0x0000000140534000-memory.dmp themida behavioral1/memory/1400-54-0x000000013FC10000-0x0000000140534000-memory.dmp themida behavioral1/memory/1400-55-0x000000013FC10000-0x0000000140534000-memory.dmp themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida behavioral1/memory/464-61-0x000000013FDE0000-0x0000000140704000-memory.dmp themida behavioral1/memory/464-62-0x000000013FDE0000-0x0000000140704000-memory.dmp themida behavioral1/memory/464-63-0x000000013FDE0000-0x0000000140704000-memory.dmp themida -
Processes:
6b73040840cf675d89f95e643476ce10.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6b73040840cf675d89f95e643476ce10.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
6b73040840cf675d89f95e643476ce10.exeIntelRapid.exepid process 1400 6b73040840cf675d89f95e643476ce10.exe 464 IntelRapid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
IntelRapid.exepid process 464 IntelRapid.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
6b73040840cf675d89f95e643476ce10.exedescription pid process target process PID 1400 wrote to memory of 464 1400 6b73040840cf675d89f95e643476ce10.exe IntelRapid.exe PID 1400 wrote to memory of 464 1400 6b73040840cf675d89f95e643476ce10.exe IntelRapid.exe PID 1400 wrote to memory of 464 1400 6b73040840cf675d89f95e643476ce10.exe IntelRapid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b73040840cf675d89f95e643476ce10.exe"C:\Users\Admin\AppData\Local\Temp\6b73040840cf675d89f95e643476ce10.exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
6b73040840cf675d89f95e643476ce10
SHA104b5c30cdb12d2f271e7111bb1e3b7f25927642b
SHA2563a650900dde9c97d1c23110b2b04ba2c5d861e48f05d894d1022e8875361869b
SHA512041a0ff85149de77e5a1a0fd3c6f140ce93b5a8328b3390ac12d95abca4e5f437d7d6b4954b9585cdb5e4ac93d790782e06f02c637e64f33e892104efd9a8db5
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
6b73040840cf675d89f95e643476ce10
SHA104b5c30cdb12d2f271e7111bb1e3b7f25927642b
SHA2563a650900dde9c97d1c23110b2b04ba2c5d861e48f05d894d1022e8875361869b
SHA512041a0ff85149de77e5a1a0fd3c6f140ce93b5a8328b3390ac12d95abca4e5f437d7d6b4954b9585cdb5e4ac93d790782e06f02c637e64f33e892104efd9a8db5
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
6b73040840cf675d89f95e643476ce10
SHA104b5c30cdb12d2f271e7111bb1e3b7f25927642b
SHA2563a650900dde9c97d1c23110b2b04ba2c5d861e48f05d894d1022e8875361869b
SHA512041a0ff85149de77e5a1a0fd3c6f140ce93b5a8328b3390ac12d95abca4e5f437d7d6b4954b9585cdb5e4ac93d790782e06f02c637e64f33e892104efd9a8db5
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
6b73040840cf675d89f95e643476ce10
SHA104b5c30cdb12d2f271e7111bb1e3b7f25927642b
SHA2563a650900dde9c97d1c23110b2b04ba2c5d861e48f05d894d1022e8875361869b
SHA512041a0ff85149de77e5a1a0fd3c6f140ce93b5a8328b3390ac12d95abca4e5f437d7d6b4954b9585cdb5e4ac93d790782e06f02c637e64f33e892104efd9a8db5
-
memory/464-61-0x000000013FDE0000-0x0000000140704000-memory.dmpFilesize
9.1MB
-
memory/464-62-0x000000013FDE0000-0x0000000140704000-memory.dmpFilesize
9.1MB
-
memory/464-63-0x000000013FDE0000-0x0000000140704000-memory.dmpFilesize
9.1MB
-
memory/1400-53-0x000000013FC10000-0x0000000140534000-memory.dmpFilesize
9.1MB
-
memory/1400-54-0x000000013FC10000-0x0000000140534000-memory.dmpFilesize
9.1MB
-
memory/1400-55-0x000000013FC10000-0x0000000140534000-memory.dmpFilesize
9.1MB
-
memory/1400-56-0x000007FEFC521000-0x000007FEFC523000-memory.dmpFilesize
8KB