Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
23-01-2022 12:53
Static task
static1
General
-
Target
cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exe
-
Size
3.4MB
-
MD5
ee0f6009d040280e5b70a11f597faae5
-
SHA1
04153d81ab5b38e70525120815ed67b41e33610b
-
SHA256
cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d
-
SHA512
076e60218db84bf8a97522024b307b1e9c8a7709a9b9dd758103bcb2be4f5c48a046027087c2b8dbaeaea8879ebffbc0a08ded9940a42213a405b0563610b447
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
IntelRapid.exepid process 4048 IntelRapid.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
IntelRapid.execb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe -
Drops startup file 1 IoCs
Processes:
cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exe -
Processes:
resource yara_rule behavioral1/memory/3416-115-0x00007FF6B6D20000-0x00007FF6B767F000-memory.dmp themida behavioral1/memory/3416-116-0x00007FF6B6D20000-0x00007FF6B767F000-memory.dmp themida behavioral1/memory/3416-117-0x00007FF6B6D20000-0x00007FF6B767F000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida behavioral1/memory/4048-120-0x00007FF753280000-0x00007FF753BDF000-memory.dmp themida behavioral1/memory/4048-121-0x00007FF753280000-0x00007FF753BDF000-memory.dmp themida behavioral1/memory/4048-122-0x00007FF753280000-0x00007FF753BDF000-memory.dmp themida -
Processes:
cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exeIntelRapid.exepid process 3416 cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exe 4048 IntelRapid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
IntelRapid.exepid process 4048 IntelRapid.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exedescription pid process target process PID 3416 wrote to memory of 4048 3416 cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exe IntelRapid.exe PID 3416 wrote to memory of 4048 3416 cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exe IntelRapid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exe"C:\Users\Admin\AppData\Local\Temp\cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d.exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
ee0f6009d040280e5b70a11f597faae5
SHA104153d81ab5b38e70525120815ed67b41e33610b
SHA256cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d
SHA512076e60218db84bf8a97522024b307b1e9c8a7709a9b9dd758103bcb2be4f5c48a046027087c2b8dbaeaea8879ebffbc0a08ded9940a42213a405b0563610b447
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
ee0f6009d040280e5b70a11f597faae5
SHA104153d81ab5b38e70525120815ed67b41e33610b
SHA256cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d
SHA512076e60218db84bf8a97522024b307b1e9c8a7709a9b9dd758103bcb2be4f5c48a046027087c2b8dbaeaea8879ebffbc0a08ded9940a42213a405b0563610b447
-
memory/3416-115-0x00007FF6B6D20000-0x00007FF6B767F000-memory.dmpFilesize
9.4MB
-
memory/3416-116-0x00007FF6B6D20000-0x00007FF6B767F000-memory.dmpFilesize
9.4MB
-
memory/3416-117-0x00007FF6B6D20000-0x00007FF6B767F000-memory.dmpFilesize
9.4MB
-
memory/4048-120-0x00007FF753280000-0x00007FF753BDF000-memory.dmpFilesize
9.4MB
-
memory/4048-121-0x00007FF753280000-0x00007FF753BDF000-memory.dmpFilesize
9.4MB
-
memory/4048-122-0x00007FF753280000-0x00007FF753BDF000-memory.dmpFilesize
9.4MB