Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
23-01-2022 13:34
Static task
static1
Behavioral task
behavioral1
Sample
ee0f6009d040280e5b70a11f597faae5.exe
Resource
win7-en-20211208
General
-
Target
ee0f6009d040280e5b70a11f597faae5.exe
-
Size
3.4MB
-
MD5
ee0f6009d040280e5b70a11f597faae5
-
SHA1
04153d81ab5b38e70525120815ed67b41e33610b
-
SHA256
cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d
-
SHA512
076e60218db84bf8a97522024b307b1e9c8a7709a9b9dd758103bcb2be4f5c48a046027087c2b8dbaeaea8879ebffbc0a08ded9940a42213a405b0563610b447
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
IntelRapid.exepid process 756 IntelRapid.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ee0f6009d040280e5b70a11f597faae5.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ee0f6009d040280e5b70a11f597faae5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ee0f6009d040280e5b70a11f597faae5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe -
Drops startup file 1 IoCs
Processes:
ee0f6009d040280e5b70a11f597faae5.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk ee0f6009d040280e5b70a11f597faae5.exe -
Loads dropped DLL 3 IoCs
Processes:
ee0f6009d040280e5b70a11f597faae5.exepid process 1740 ee0f6009d040280e5b70a11f597faae5.exe 1740 ee0f6009d040280e5b70a11f597faae5.exe 1740 ee0f6009d040280e5b70a11f597faae5.exe -
Processes:
resource yara_rule behavioral1/memory/1740-54-0x000000013FE10000-0x000000014076F000-memory.dmp themida behavioral1/memory/1740-55-0x000000013FE10000-0x000000014076F000-memory.dmp themida behavioral1/memory/1740-56-0x000000013FE10000-0x000000014076F000-memory.dmp themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida behavioral1/memory/756-62-0x000000013FF10000-0x000000014086F000-memory.dmp themida behavioral1/memory/756-63-0x000000013FF10000-0x000000014086F000-memory.dmp themida behavioral1/memory/756-64-0x000000013FF10000-0x000000014086F000-memory.dmp themida -
Processes:
ee0f6009d040280e5b70a11f597faae5.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ee0f6009d040280e5b70a11f597faae5.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
ee0f6009d040280e5b70a11f597faae5.exeIntelRapid.exepid process 1740 ee0f6009d040280e5b70a11f597faae5.exe 756 IntelRapid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
IntelRapid.exepid process 756 IntelRapid.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ee0f6009d040280e5b70a11f597faae5.exedescription pid process target process PID 1740 wrote to memory of 756 1740 ee0f6009d040280e5b70a11f597faae5.exe IntelRapid.exe PID 1740 wrote to memory of 756 1740 ee0f6009d040280e5b70a11f597faae5.exe IntelRapid.exe PID 1740 wrote to memory of 756 1740 ee0f6009d040280e5b70a11f597faae5.exe IntelRapid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee0f6009d040280e5b70a11f597faae5.exe"C:\Users\Admin\AppData\Local\Temp\ee0f6009d040280e5b70a11f597faae5.exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
ee0f6009d040280e5b70a11f597faae5
SHA104153d81ab5b38e70525120815ed67b41e33610b
SHA256cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d
SHA512076e60218db84bf8a97522024b307b1e9c8a7709a9b9dd758103bcb2be4f5c48a046027087c2b8dbaeaea8879ebffbc0a08ded9940a42213a405b0563610b447
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
ee0f6009d040280e5b70a11f597faae5
SHA104153d81ab5b38e70525120815ed67b41e33610b
SHA256cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d
SHA512076e60218db84bf8a97522024b307b1e9c8a7709a9b9dd758103bcb2be4f5c48a046027087c2b8dbaeaea8879ebffbc0a08ded9940a42213a405b0563610b447
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
ee0f6009d040280e5b70a11f597faae5
SHA104153d81ab5b38e70525120815ed67b41e33610b
SHA256cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d
SHA512076e60218db84bf8a97522024b307b1e9c8a7709a9b9dd758103bcb2be4f5c48a046027087c2b8dbaeaea8879ebffbc0a08ded9940a42213a405b0563610b447
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
ee0f6009d040280e5b70a11f597faae5
SHA104153d81ab5b38e70525120815ed67b41e33610b
SHA256cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d
SHA512076e60218db84bf8a97522024b307b1e9c8a7709a9b9dd758103bcb2be4f5c48a046027087c2b8dbaeaea8879ebffbc0a08ded9940a42213a405b0563610b447
-
memory/756-62-0x000000013FF10000-0x000000014086F000-memory.dmpFilesize
9.4MB
-
memory/756-63-0x000000013FF10000-0x000000014086F000-memory.dmpFilesize
9.4MB
-
memory/756-64-0x000000013FF10000-0x000000014086F000-memory.dmpFilesize
9.4MB
-
memory/1740-54-0x000000013FE10000-0x000000014076F000-memory.dmpFilesize
9.4MB
-
memory/1740-55-0x000000013FE10000-0x000000014076F000-memory.dmpFilesize
9.4MB
-
memory/1740-56-0x000000013FE10000-0x000000014076F000-memory.dmpFilesize
9.4MB
-
memory/1740-57-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmpFilesize
8KB