Analysis
-
max time kernel
117s -
max time network
126s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12-02-2022 07:31
Static task
static1
Behavioral task
behavioral1
Sample
80805036184d9ff94a32bad39ba0a553.exe
Resource
win7-en-20211208
General
-
Target
80805036184d9ff94a32bad39ba0a553.exe
-
Size
3.4MB
-
MD5
80805036184d9ff94a32bad39ba0a553
-
SHA1
4dfa5e8254755da7c2c589efb7467bd0b67aaa98
-
SHA256
6c334c7c715f8385c04cc37cf4ee14760c2683a23e3e5c5164f4cbe4ec0988d1
-
SHA512
b50455b82b1cef724dc3e6987976d8f3cd31bc5196a8cc1f6a941fe14e4486fa2cec4501560a5c2395bdceecc16ea074fe72901a3ed58da379befdadceb3104b
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
IntelRapid.exepid process 584 IntelRapid.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
80805036184d9ff94a32bad39ba0a553.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 80805036184d9ff94a32bad39ba0a553.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 80805036184d9ff94a32bad39ba0a553.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe -
Drops startup file 1 IoCs
Processes:
80805036184d9ff94a32bad39ba0a553.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk 80805036184d9ff94a32bad39ba0a553.exe -
Loads dropped DLL 3 IoCs
Processes:
80805036184d9ff94a32bad39ba0a553.exepid process 1748 80805036184d9ff94a32bad39ba0a553.exe 1748 80805036184d9ff94a32bad39ba0a553.exe 1748 80805036184d9ff94a32bad39ba0a553.exe -
Processes:
resource yara_rule behavioral1/memory/1748-55-0x000000013F720000-0x0000000140043000-memory.dmp themida behavioral1/memory/1748-56-0x000000013F720000-0x0000000140043000-memory.dmp themida behavioral1/memory/1748-57-0x000000013F720000-0x0000000140043000-memory.dmp themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida behavioral1/memory/584-63-0x000000013F810000-0x0000000140133000-memory.dmp themida behavioral1/memory/584-64-0x000000013F810000-0x0000000140133000-memory.dmp themida behavioral1/memory/584-65-0x000000013F810000-0x0000000140133000-memory.dmp themida -
Processes:
80805036184d9ff94a32bad39ba0a553.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 80805036184d9ff94a32bad39ba0a553.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
80805036184d9ff94a32bad39ba0a553.exeIntelRapid.exepid process 1748 80805036184d9ff94a32bad39ba0a553.exe 584 IntelRapid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
IntelRapid.exepid process 584 IntelRapid.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
80805036184d9ff94a32bad39ba0a553.exedescription pid process target process PID 1748 wrote to memory of 584 1748 80805036184d9ff94a32bad39ba0a553.exe IntelRapid.exe PID 1748 wrote to memory of 584 1748 80805036184d9ff94a32bad39ba0a553.exe IntelRapid.exe PID 1748 wrote to memory of 584 1748 80805036184d9ff94a32bad39ba0a553.exe IntelRapid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\80805036184d9ff94a32bad39ba0a553.exe"C:\Users\Admin\AppData\Local\Temp\80805036184d9ff94a32bad39ba0a553.exe"1⤵
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
PID:584
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
80805036184d9ff94a32bad39ba0a553
SHA14dfa5e8254755da7c2c589efb7467bd0b67aaa98
SHA2566c334c7c715f8385c04cc37cf4ee14760c2683a23e3e5c5164f4cbe4ec0988d1
SHA512b50455b82b1cef724dc3e6987976d8f3cd31bc5196a8cc1f6a941fe14e4486fa2cec4501560a5c2395bdceecc16ea074fe72901a3ed58da379befdadceb3104b
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
80805036184d9ff94a32bad39ba0a553
SHA14dfa5e8254755da7c2c589efb7467bd0b67aaa98
SHA2566c334c7c715f8385c04cc37cf4ee14760c2683a23e3e5c5164f4cbe4ec0988d1
SHA512b50455b82b1cef724dc3e6987976d8f3cd31bc5196a8cc1f6a941fe14e4486fa2cec4501560a5c2395bdceecc16ea074fe72901a3ed58da379befdadceb3104b
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
80805036184d9ff94a32bad39ba0a553
SHA14dfa5e8254755da7c2c589efb7467bd0b67aaa98
SHA2566c334c7c715f8385c04cc37cf4ee14760c2683a23e3e5c5164f4cbe4ec0988d1
SHA512b50455b82b1cef724dc3e6987976d8f3cd31bc5196a8cc1f6a941fe14e4486fa2cec4501560a5c2395bdceecc16ea074fe72901a3ed58da379befdadceb3104b
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
80805036184d9ff94a32bad39ba0a553
SHA14dfa5e8254755da7c2c589efb7467bd0b67aaa98
SHA2566c334c7c715f8385c04cc37cf4ee14760c2683a23e3e5c5164f4cbe4ec0988d1
SHA512b50455b82b1cef724dc3e6987976d8f3cd31bc5196a8cc1f6a941fe14e4486fa2cec4501560a5c2395bdceecc16ea074fe72901a3ed58da379befdadceb3104b
-
memory/584-63-0x000000013F810000-0x0000000140133000-memory.dmpFilesize
9.1MB
-
memory/584-64-0x000000013F810000-0x0000000140133000-memory.dmpFilesize
9.1MB
-
memory/584-65-0x000000013F810000-0x0000000140133000-memory.dmpFilesize
9.1MB
-
memory/1748-54-0x0000000077490000-0x0000000077492000-memory.dmpFilesize
8KB
-
memory/1748-55-0x000000013F720000-0x0000000140043000-memory.dmpFilesize
9.1MB
-
memory/1748-56-0x000000013F720000-0x0000000140043000-memory.dmpFilesize
9.1MB
-
memory/1748-57-0x000000013F720000-0x0000000140043000-memory.dmpFilesize
9.1MB
-
memory/1748-58-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmpFilesize
8KB