Analysis
-
max time kernel
141s -
max time network
167s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
04-02-2022 17:49
Static task
static1
Behavioral task
behavioral1
Sample
59b67729203f5f66974b5fa8c2daaed6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
59b67729203f5f66974b5fa8c2daaed6.exe
Resource
win10v2004-en-20220113
General
-
Target
59b67729203f5f66974b5fa8c2daaed6.exe
-
Size
3.3MB
-
MD5
59b67729203f5f66974b5fa8c2daaed6
-
SHA1
418a6a170c78dea8fcecc19c054015f6a4d215d0
-
SHA256
42a1d242616debc2ef4264d0878adfdeb439dbfc69011d75472f0522066d7b0a
-
SHA512
1c4db10a9d0bb051ff73ea71a6bdfecfd964f654c748994aa30366c05fb03cdf24fb5d6d120aa5a1075db5d50d0989e4d04332c9ec8645b4bb67ec7deea5e7ad
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
IntelRapid.exepid process 960 IntelRapid.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
59b67729203f5f66974b5fa8c2daaed6.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 59b67729203f5f66974b5fa8c2daaed6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 59b67729203f5f66974b5fa8c2daaed6.exe -
Drops startup file 1 IoCs
Processes:
59b67729203f5f66974b5fa8c2daaed6.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk 59b67729203f5f66974b5fa8c2daaed6.exe -
Loads dropped DLL 3 IoCs
Processes:
59b67729203f5f66974b5fa8c2daaed6.exepid process 1420 59b67729203f5f66974b5fa8c2daaed6.exe 1420 59b67729203f5f66974b5fa8c2daaed6.exe 1420 59b67729203f5f66974b5fa8c2daaed6.exe -
Processes:
resource yara_rule behavioral1/memory/1420-54-0x000000013F7A0000-0x00000001400B1000-memory.dmp themida behavioral1/memory/1420-55-0x000000013F7A0000-0x00000001400B1000-memory.dmp themida behavioral1/memory/1420-56-0x000000013F7A0000-0x00000001400B1000-memory.dmp themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida behavioral1/memory/960-62-0x000000013F330000-0x000000013FC41000-memory.dmp themida behavioral1/memory/960-63-0x000000013F330000-0x000000013FC41000-memory.dmp themida behavioral1/memory/960-64-0x000000013F330000-0x000000013FC41000-memory.dmp themida -
Processes:
59b67729203f5f66974b5fa8c2daaed6.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 59b67729203f5f66974b5fa8c2daaed6.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
59b67729203f5f66974b5fa8c2daaed6.exeIntelRapid.exepid process 1420 59b67729203f5f66974b5fa8c2daaed6.exe 960 IntelRapid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
IntelRapid.exepid process 960 IntelRapid.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
59b67729203f5f66974b5fa8c2daaed6.exedescription pid process target process PID 1420 wrote to memory of 960 1420 59b67729203f5f66974b5fa8c2daaed6.exe IntelRapid.exe PID 1420 wrote to memory of 960 1420 59b67729203f5f66974b5fa8c2daaed6.exe IntelRapid.exe PID 1420 wrote to memory of 960 1420 59b67729203f5f66974b5fa8c2daaed6.exe IntelRapid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\59b67729203f5f66974b5fa8c2daaed6.exe"C:\Users\Admin\AppData\Local\Temp\59b67729203f5f66974b5fa8c2daaed6.exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
59b67729203f5f66974b5fa8c2daaed6
SHA1418a6a170c78dea8fcecc19c054015f6a4d215d0
SHA25642a1d242616debc2ef4264d0878adfdeb439dbfc69011d75472f0522066d7b0a
SHA5121c4db10a9d0bb051ff73ea71a6bdfecfd964f654c748994aa30366c05fb03cdf24fb5d6d120aa5a1075db5d50d0989e4d04332c9ec8645b4bb67ec7deea5e7ad
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
59b67729203f5f66974b5fa8c2daaed6
SHA1418a6a170c78dea8fcecc19c054015f6a4d215d0
SHA25642a1d242616debc2ef4264d0878adfdeb439dbfc69011d75472f0522066d7b0a
SHA5121c4db10a9d0bb051ff73ea71a6bdfecfd964f654c748994aa30366c05fb03cdf24fb5d6d120aa5a1075db5d50d0989e4d04332c9ec8645b4bb67ec7deea5e7ad
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
59b67729203f5f66974b5fa8c2daaed6
SHA1418a6a170c78dea8fcecc19c054015f6a4d215d0
SHA25642a1d242616debc2ef4264d0878adfdeb439dbfc69011d75472f0522066d7b0a
SHA5121c4db10a9d0bb051ff73ea71a6bdfecfd964f654c748994aa30366c05fb03cdf24fb5d6d120aa5a1075db5d50d0989e4d04332c9ec8645b4bb67ec7deea5e7ad
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
59b67729203f5f66974b5fa8c2daaed6
SHA1418a6a170c78dea8fcecc19c054015f6a4d215d0
SHA25642a1d242616debc2ef4264d0878adfdeb439dbfc69011d75472f0522066d7b0a
SHA5121c4db10a9d0bb051ff73ea71a6bdfecfd964f654c748994aa30366c05fb03cdf24fb5d6d120aa5a1075db5d50d0989e4d04332c9ec8645b4bb67ec7deea5e7ad
-
memory/960-62-0x000000013F330000-0x000000013FC41000-memory.dmpFilesize
9.1MB
-
memory/960-63-0x000000013F330000-0x000000013FC41000-memory.dmpFilesize
9.1MB
-
memory/960-64-0x000000013F330000-0x000000013FC41000-memory.dmpFilesize
9.1MB
-
memory/1420-54-0x000000013F7A0000-0x00000001400B1000-memory.dmpFilesize
9.1MB
-
memory/1420-55-0x000000013F7A0000-0x00000001400B1000-memory.dmpFilesize
9.1MB
-
memory/1420-56-0x000000013F7A0000-0x00000001400B1000-memory.dmpFilesize
9.1MB
-
memory/1420-57-0x000007FEFC511000-0x000007FEFC513000-memory.dmpFilesize
8KB