Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
23-01-2022 13:34
Static task
static1
Behavioral task
behavioral1
Sample
ee0f6009d040280e5b70a11f597faae5.exe
Resource
win7-en-20211208
General
-
Target
ee0f6009d040280e5b70a11f597faae5.exe
-
Size
3.4MB
-
MD5
ee0f6009d040280e5b70a11f597faae5
-
SHA1
04153d81ab5b38e70525120815ed67b41e33610b
-
SHA256
cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d
-
SHA512
076e60218db84bf8a97522024b307b1e9c8a7709a9b9dd758103bcb2be4f5c48a046027087c2b8dbaeaea8879ebffbc0a08ded9940a42213a405b0563610b447
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
IntelRapid.exepid process 3524 IntelRapid.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
ee0f6009d040280e5b70a11f597faae5.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ee0f6009d040280e5b70a11f597faae5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ee0f6009d040280e5b70a11f597faae5.exe -
Drops startup file 1 IoCs
Processes:
ee0f6009d040280e5b70a11f597faae5.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk ee0f6009d040280e5b70a11f597faae5.exe -
Processes:
resource yara_rule behavioral2/memory/2652-115-0x00007FF66C770000-0x00007FF66D0CF000-memory.dmp themida behavioral2/memory/2652-116-0x00007FF66C770000-0x00007FF66D0CF000-memory.dmp themida behavioral2/memory/2652-117-0x00007FF66C770000-0x00007FF66D0CF000-memory.dmp themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida behavioral2/memory/3524-120-0x00007FF6DA250000-0x00007FF6DABAF000-memory.dmp themida behavioral2/memory/3524-121-0x00007FF6DA250000-0x00007FF6DABAF000-memory.dmp themida behavioral2/memory/3524-122-0x00007FF6DA250000-0x00007FF6DABAF000-memory.dmp themida -
Processes:
ee0f6009d040280e5b70a11f597faae5.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ee0f6009d040280e5b70a11f597faae5.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
ee0f6009d040280e5b70a11f597faae5.exeIntelRapid.exepid process 2652 ee0f6009d040280e5b70a11f597faae5.exe 3524 IntelRapid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
IntelRapid.exepid process 3524 IntelRapid.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
ee0f6009d040280e5b70a11f597faae5.exedescription pid process target process PID 2652 wrote to memory of 3524 2652 ee0f6009d040280e5b70a11f597faae5.exe IntelRapid.exe PID 2652 wrote to memory of 3524 2652 ee0f6009d040280e5b70a11f597faae5.exe IntelRapid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee0f6009d040280e5b70a11f597faae5.exe"C:\Users\Admin\AppData\Local\Temp\ee0f6009d040280e5b70a11f597faae5.exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
ee0f6009d040280e5b70a11f597faae5
SHA104153d81ab5b38e70525120815ed67b41e33610b
SHA256cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d
SHA512076e60218db84bf8a97522024b307b1e9c8a7709a9b9dd758103bcb2be4f5c48a046027087c2b8dbaeaea8879ebffbc0a08ded9940a42213a405b0563610b447
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
ee0f6009d040280e5b70a11f597faae5
SHA104153d81ab5b38e70525120815ed67b41e33610b
SHA256cb83f7793fb45301ea771d25d9b47f50e00e9a0b2faf41f483dac3be63eeb15d
SHA512076e60218db84bf8a97522024b307b1e9c8a7709a9b9dd758103bcb2be4f5c48a046027087c2b8dbaeaea8879ebffbc0a08ded9940a42213a405b0563610b447
-
memory/2652-115-0x00007FF66C770000-0x00007FF66D0CF000-memory.dmpFilesize
9.4MB
-
memory/2652-116-0x00007FF66C770000-0x00007FF66D0CF000-memory.dmpFilesize
9.4MB
-
memory/2652-117-0x00007FF66C770000-0x00007FF66D0CF000-memory.dmpFilesize
9.4MB
-
memory/3524-120-0x00007FF6DA250000-0x00007FF6DABAF000-memory.dmpFilesize
9.4MB
-
memory/3524-121-0x00007FF6DA250000-0x00007FF6DABAF000-memory.dmpFilesize
9.4MB
-
memory/3524-122-0x00007FF6DA250000-0x00007FF6DABAF000-memory.dmpFilesize
9.4MB