ddc739b6d73bd1dc3f6cd7be4daced463081b6a8baffd3fee7931f529e9c23fd

General

Target

b2bbe95f39b1fa0ebaa00d29041e81ba.exe
Size

3.5MB
MD5

b2bbe95f39b1fa0ebaa00d29041e81ba
SHA1

197b85e8d120d623a2b5b2d9357096042232ab7d
SHA256

ddc739b6d73bd1dc3f6cd7be4daced463081b6a8baffd3fee7931f529e9c23fd
SHA512

88152164f1287bb17bda63721451af814c0c60873c8e66a619b0c1433901c074b5fc5011d85c7c07a7c3134d2625ea7bfab60f0cdaf422d200fb9a3c05a30b29

Score

9^/10

evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 1 IoCs

Processes:

IntelRapid.exe

pid process

2112 IntelRapid.exe

pid	process
2112	IntelRapid.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b2bbe95f39b1fa0ebaa00d29041e81ba.exeIntelRapid.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b2bbe95f39b1fa0ebaa00d29041e81ba.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b2bbe95f39b1fa0ebaa00d29041e81ba.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IntelRapid.exe

Drops startup file 1 IoCs

Processes:

b2bbe95f39b1fa0ebaa00d29041e81ba.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk	b2bbe95f39b1fa0ebaa00d29041e81ba.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/2700-118-0x00007FF7B54D0000-0x00007FF7B5E4B000-memory.dmp	themida
behavioral2/memory/2700-119-0x00007FF7B54D0000-0x00007FF7B5E4B000-memory.dmp	themida
behavioral2/memory/2700-120-0x00007FF7B54D0000-0x00007FF7B5E4B000-memory.dmp	themida
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe	themida
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe	themida
behavioral2/memory/2112-123-0x00007FF695BE0000-0x00007FF69655B000-memory.dmp	themida
behavioral2/memory/2112-124-0x00007FF695BE0000-0x00007FF69655B000-memory.dmp	themida
behavioral2/memory/2112-125-0x00007FF695BE0000-0x00007FF69655B000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

IntelRapid.exeb2bbe95f39b1fa0ebaa00d29041e81ba.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	IntelRapid.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b2bbe95f39b1fa0ebaa00d29041e81ba.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

b2bbe95f39b1fa0ebaa00d29041e81ba.exeIntelRapid.exe

pid process

2700 b2bbe95f39b1fa0ebaa00d29041e81ba.exe
2112 IntelRapid.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

IntelRapid.exe

pid process

2112 IntelRapid.exe

pid	process
2700	b2bbe95f39b1fa0ebaa00d29041e81ba.exe
2112	IntelRapid.exe

pid	process
2112	IntelRapid.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

b2bbe95f39b1fa0ebaa00d29041e81ba.exe

description	pid	process	target process
PID 2700 wrote to memory of 2112	2700	b2bbe95f39b1fa0ebaa00d29041e81ba.exe	IntelRapid.exe
PID 2700 wrote to memory of 2112	2700	b2bbe95f39b1fa0ebaa00d29041e81ba.exe	IntelRapid.exe

C:\Users\Admin\AppData\Local\Temp\b2bbe95f39b1fa0ebaa00d29041e81ba.exe
"C:\Users\Admin\AppData\Local\Temp\b2bbe95f39b1fa0ebaa00d29041e81ba.exe"
1⤵
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2700

C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
PID:2112

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
MD5
b2bbe95f39b1fa0ebaa00d29041e81ba

SHA1
197b85e8d120d623a2b5b2d9357096042232ab7d

SHA256
ddc739b6d73bd1dc3f6cd7be4daced463081b6a8baffd3fee7931f529e9c23fd

SHA512
88152164f1287bb17bda63721451af814c0c60873c8e66a619b0c1433901c074b5fc5011d85c7c07a7c3134d2625ea7bfab60f0cdaf422d200fb9a3c05a30b29

Download Submit
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
MD5
b2bbe95f39b1fa0ebaa00d29041e81ba

SHA1
197b85e8d120d623a2b5b2d9357096042232ab7d

SHA256
ddc739b6d73bd1dc3f6cd7be4daced463081b6a8baffd3fee7931f529e9c23fd

SHA512
88152164f1287bb17bda63721451af814c0c60873c8e66a619b0c1433901c074b5fc5011d85c7c07a7c3134d2625ea7bfab60f0cdaf422d200fb9a3c05a30b29

Download Submit
memory/2112-123-0x00007FF695BE0000-0x00007FF69655B000-memory.dmp

Filesize
9.5MB

Download
memory/2112-124-0x00007FF695BE0000-0x00007FF69655B000-memory.dmp

Filesize
9.5MB

Download
memory/2112-125-0x00007FF695BE0000-0x00007FF69655B000-memory.dmp

Filesize
9.5MB

Download
memory/2700-118-0x00007FF7B54D0000-0x00007FF7B5E4B000-memory.dmp

Filesize
9.5MB

Download
memory/2700-119-0x00007FF7B54D0000-0x00007FF7B5E4B000-memory.dmp

Filesize
9.5MB

Download
memory/2700-120-0x00007FF7B54D0000-0x00007FF7B5E4B000-memory.dmp

Filesize
9.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads