Analysis
-
max time kernel
118s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-02-2022 06:54
Static task
static1
Behavioral task
behavioral1
Sample
b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe
Resource
win7-en-20211208
General
-
Target
b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe
-
Size
6.1MB
-
MD5
d17ddf62b40c19e794160069d3e970ae
-
SHA1
d0371179c03af231a8b07d175141944cb32a5115
-
SHA256
b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9
-
SHA512
5b1a40e9a2399c6bb7dffd4340859a91a3acc6b8f28e7cafdc1d8df74be1f8a2bb63e76f14305788654f862f3247805cbcf3a94059496e154b5bd239e4eebc7f
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Blocklisted process makes network request 4 IoCs
Processes:
WScript.exeflow pid process 13 1064 WScript.exe 14 1064 WScript.exe 15 1064 WScript.exe 16 1064 WScript.exe -
Executes dropped EXE 3 IoCs
Processes:
before.execleoidvp.exeIntelRapid.exepid process 772 before.exe 1076 cleoidvp.exe 1200 IntelRapid.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
cleoidvp.exebefore.exeIntelRapid.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cleoidvp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion before.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion before.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion IntelRapid.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cleoidvp.exe -
Drops startup file 1 IoCs
Processes:
before.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelRapid.lnk before.exe -
Loads dropped DLL 9 IoCs
Processes:
b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exebefore.execleoidvp.exepid process 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe 772 before.exe 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe 1076 cleoidvp.exe 1076 cleoidvp.exe 772 before.exe 772 before.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\droopt\before.exe themida \Users\Admin\AppData\Local\Temp\droopt\before.exe themida C:\Users\Admin\AppData\Local\Temp\droopt\before.exe themida behavioral1/memory/772-60-0x000000013F920000-0x00000001402A0000-memory.dmp themida behavioral1/memory/772-61-0x000000013F920000-0x00000001402A0000-memory.dmp themida behavioral1/memory/772-62-0x000000013F920000-0x00000001402A0000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\droopt\before.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Local\Temp\droopt\cleoidvp.exe themida C:\Users\Admin\AppData\Local\Temp\droopt\cleoidvp.exe themida \Users\Admin\AppData\Local\Temp\droopt\cleoidvp.exe themida C:\Users\Admin\AppData\Local\Temp\droopt\cleoidvp.exe themida \Users\Admin\AppData\Local\Temp\droopt\cleoidvp.exe themida C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida \Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe themida behavioral1/memory/1200-76-0x000000013F230000-0x000000013FBB0000-memory.dmp themida behavioral1/memory/1200-77-0x000000013F230000-0x000000013FBB0000-memory.dmp themida behavioral1/memory/1200-78-0x000000013F230000-0x000000013FBB0000-memory.dmp themida behavioral1/memory/1076-79-0x0000000001300000-0x0000000001976000-memory.dmp themida behavioral1/memory/1076-81-0x0000000001300000-0x0000000001976000-memory.dmp themida behavioral1/memory/1076-82-0x0000000001300000-0x0000000001976000-memory.dmp themida behavioral1/memory/1076-83-0x0000000001300000-0x0000000001976000-memory.dmp themida -
Processes:
before.exeIntelRapid.execleoidvp.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA before.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IntelRapid.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cleoidvp.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
before.exeIntelRapid.execleoidvp.exepid process 772 before.exe 1200 IntelRapid.exe 1076 cleoidvp.exe -
Drops file in Program Files directory 3 IoCs
Processes:
b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exedescription ioc process File created C:\Program Files (x86)\foler\olader\acppage.dll b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe File created C:\Program Files (x86)\foler\olader\adprovider.dll b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe File created C:\Program Files (x86)\foler\olader\acledit.dll b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
cleoidvp.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 cleoidvp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString cleoidvp.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
IntelRapid.exepid process 1200 IntelRapid.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
cleoidvp.exepid process 1076 cleoidvp.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exebefore.execleoidvp.exedescription pid process target process PID 1108 wrote to memory of 772 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe before.exe PID 1108 wrote to memory of 772 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe before.exe PID 1108 wrote to memory of 772 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe before.exe PID 1108 wrote to memory of 772 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe before.exe PID 1108 wrote to memory of 1076 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe cleoidvp.exe PID 1108 wrote to memory of 1076 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe cleoidvp.exe PID 1108 wrote to memory of 1076 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe cleoidvp.exe PID 1108 wrote to memory of 1076 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe cleoidvp.exe PID 1108 wrote to memory of 1076 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe cleoidvp.exe PID 1108 wrote to memory of 1076 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe cleoidvp.exe PID 1108 wrote to memory of 1076 1108 b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe cleoidvp.exe PID 772 wrote to memory of 1200 772 before.exe IntelRapid.exe PID 772 wrote to memory of 1200 772 before.exe IntelRapid.exe PID 772 wrote to memory of 1200 772 before.exe IntelRapid.exe PID 1076 wrote to memory of 1680 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1680 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1680 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1680 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1680 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1680 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1680 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1064 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1064 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1064 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1064 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1064 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1064 1076 cleoidvp.exe WScript.exe PID 1076 wrote to memory of 1064 1076 cleoidvp.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe"C:\Users\Admin\AppData\Local\Temp\b543353168aed0d8f97bf242c27cebcae520a36aabbd5feddf3331611ec5afc9.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\droopt\before.exe"C:\Users\Admin\AppData\Local\Temp\droopt\before.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops startup file
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Local\Temp\droopt\cleoidvp.exe"C:\Users\Admin\AppData\Local\Temp\droopt\cleoidvp.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\yrslnejiua.vbs"3⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wsgpbqpan.vbs"3⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\droopt\before.exeMD5
8aee61bc611aa64b3f208f3a078c0b9d
SHA1fbd8b1f97262825748f2314ea5357c513928d450
SHA256c83e1a89de66553006542f3d2906b833bd0eec1eaaf9d6a7a791ff2224055e55
SHA512a842860b4932d89911731e634b35707affca7977fa08e3f0a874661cd3da63c34d048c9203d670108726b3a0a94e173dff7eccb8c18b3cadf2233098e7e70439
-
C:\Users\Admin\AppData\Local\Temp\droopt\before.exeMD5
8aee61bc611aa64b3f208f3a078c0b9d
SHA1fbd8b1f97262825748f2314ea5357c513928d450
SHA256c83e1a89de66553006542f3d2906b833bd0eec1eaaf9d6a7a791ff2224055e55
SHA512a842860b4932d89911731e634b35707affca7977fa08e3f0a874661cd3da63c34d048c9203d670108726b3a0a94e173dff7eccb8c18b3cadf2233098e7e70439
-
C:\Users\Admin\AppData\Local\Temp\droopt\cleoidvp.exeMD5
dc8d694f9146f0612c47d12c2d1f207a
SHA1210209e9bd1ebfc68febb35e419657e8f279151c
SHA2568f62751fd75e19987374eaaf8c14ba2d689514c9677c00324b267a90513606c9
SHA5125cf6836af46438886b1844f762939d43603555fcee45d6dc52da56f2912b06e496742b83f01817009d9cebdeba0b0912ecee9115252e70d131a7fed8cec19191
-
C:\Users\Admin\AppData\Local\Temp\droopt\cleoidvp.exeMD5
dc8d694f9146f0612c47d12c2d1f207a
SHA1210209e9bd1ebfc68febb35e419657e8f279151c
SHA2568f62751fd75e19987374eaaf8c14ba2d689514c9677c00324b267a90513606c9
SHA5125cf6836af46438886b1844f762939d43603555fcee45d6dc52da56f2912b06e496742b83f01817009d9cebdeba0b0912ecee9115252e70d131a7fed8cec19191
-
C:\Users\Admin\AppData\Local\Temp\wsgpbqpan.vbsMD5
4864d00d02f74079a69eafa9110d30e9
SHA1c7945334e5c4ce155e12d849cbf3add64ce4cc21
SHA256c3ed64b58f92539f973a153a2cad0b489e2b57852bf518b98b4b80437e5d5011
SHA5123d010c589c000f61d8f8506cf1e669c2c357fe7f823fce59c3731207a9b770e9829a484c9699bdd62bc3cec6424684d24c4f2e095dabcc501d415b1923f3266a
-
C:\Users\Admin\AppData\Local\Temp\yrslnejiua.vbsMD5
fa6215e58d2dc27bdecc54f43e26081e
SHA148b81f22042099162227b42009228220b01b415b
SHA25664e4ee186051b7ddc10516fba8e9be5d6f5bdd092b4487959d5201e78943e66c
SHA5121affbd82a3e7807967b7e98ce958425fd7e42e96324b70b94107577488d9825ee820a8097efe2f61cf7cdc3343278ed08be8a00ee8157f7062bae79de4ca097d
-
C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
8aee61bc611aa64b3f208f3a078c0b9d
SHA1fbd8b1f97262825748f2314ea5357c513928d450
SHA256c83e1a89de66553006542f3d2906b833bd0eec1eaaf9d6a7a791ff2224055e55
SHA512a842860b4932d89911731e634b35707affca7977fa08e3f0a874661cd3da63c34d048c9203d670108726b3a0a94e173dff7eccb8c18b3cadf2233098e7e70439
-
\Users\Admin\AppData\Local\Temp\droopt\before.exeMD5
8aee61bc611aa64b3f208f3a078c0b9d
SHA1fbd8b1f97262825748f2314ea5357c513928d450
SHA256c83e1a89de66553006542f3d2906b833bd0eec1eaaf9d6a7a791ff2224055e55
SHA512a842860b4932d89911731e634b35707affca7977fa08e3f0a874661cd3da63c34d048c9203d670108726b3a0a94e173dff7eccb8c18b3cadf2233098e7e70439
-
\Users\Admin\AppData\Local\Temp\droopt\before.exeMD5
8aee61bc611aa64b3f208f3a078c0b9d
SHA1fbd8b1f97262825748f2314ea5357c513928d450
SHA256c83e1a89de66553006542f3d2906b833bd0eec1eaaf9d6a7a791ff2224055e55
SHA512a842860b4932d89911731e634b35707affca7977fa08e3f0a874661cd3da63c34d048c9203d670108726b3a0a94e173dff7eccb8c18b3cadf2233098e7e70439
-
\Users\Admin\AppData\Local\Temp\droopt\cleoidvp.exeMD5
dc8d694f9146f0612c47d12c2d1f207a
SHA1210209e9bd1ebfc68febb35e419657e8f279151c
SHA2568f62751fd75e19987374eaaf8c14ba2d689514c9677c00324b267a90513606c9
SHA5125cf6836af46438886b1844f762939d43603555fcee45d6dc52da56f2912b06e496742b83f01817009d9cebdeba0b0912ecee9115252e70d131a7fed8cec19191
-
\Users\Admin\AppData\Local\Temp\droopt\cleoidvp.exeMD5
dc8d694f9146f0612c47d12c2d1f207a
SHA1210209e9bd1ebfc68febb35e419657e8f279151c
SHA2568f62751fd75e19987374eaaf8c14ba2d689514c9677c00324b267a90513606c9
SHA5125cf6836af46438886b1844f762939d43603555fcee45d6dc52da56f2912b06e496742b83f01817009d9cebdeba0b0912ecee9115252e70d131a7fed8cec19191
-
\Users\Admin\AppData\Local\Temp\droopt\cleoidvp.exeMD5
dc8d694f9146f0612c47d12c2d1f207a
SHA1210209e9bd1ebfc68febb35e419657e8f279151c
SHA2568f62751fd75e19987374eaaf8c14ba2d689514c9677c00324b267a90513606c9
SHA5125cf6836af46438886b1844f762939d43603555fcee45d6dc52da56f2912b06e496742b83f01817009d9cebdeba0b0912ecee9115252e70d131a7fed8cec19191
-
\Users\Admin\AppData\Local\Temp\nsy17E5.tmp\UAC.dllMD5
adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
8aee61bc611aa64b3f208f3a078c0b9d
SHA1fbd8b1f97262825748f2314ea5357c513928d450
SHA256c83e1a89de66553006542f3d2906b833bd0eec1eaaf9d6a7a791ff2224055e55
SHA512a842860b4932d89911731e634b35707affca7977fa08e3f0a874661cd3da63c34d048c9203d670108726b3a0a94e173dff7eccb8c18b3cadf2233098e7e70439
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
8aee61bc611aa64b3f208f3a078c0b9d
SHA1fbd8b1f97262825748f2314ea5357c513928d450
SHA256c83e1a89de66553006542f3d2906b833bd0eec1eaaf9d6a7a791ff2224055e55
SHA512a842860b4932d89911731e634b35707affca7977fa08e3f0a874661cd3da63c34d048c9203d670108726b3a0a94e173dff7eccb8c18b3cadf2233098e7e70439
-
\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exeMD5
8aee61bc611aa64b3f208f3a078c0b9d
SHA1fbd8b1f97262825748f2314ea5357c513928d450
SHA256c83e1a89de66553006542f3d2906b833bd0eec1eaaf9d6a7a791ff2224055e55
SHA512a842860b4932d89911731e634b35707affca7977fa08e3f0a874661cd3da63c34d048c9203d670108726b3a0a94e173dff7eccb8c18b3cadf2233098e7e70439
-
memory/772-62-0x000000013F920000-0x00000001402A0000-memory.dmpFilesize
9.5MB
-
memory/772-65-0x0000000076F50000-0x0000000076F52000-memory.dmpFilesize
8KB
-
memory/772-64-0x000007FEFB781000-0x000007FEFB783000-memory.dmpFilesize
8KB
-
memory/772-60-0x000000013F920000-0x00000001402A0000-memory.dmpFilesize
9.5MB
-
memory/772-61-0x000000013F920000-0x00000001402A0000-memory.dmpFilesize
9.5MB
-
memory/1076-82-0x0000000001300000-0x0000000001976000-memory.dmpFilesize
6.5MB
-
memory/1076-79-0x0000000001300000-0x0000000001976000-memory.dmpFilesize
6.5MB
-
memory/1076-81-0x0000000001300000-0x0000000001976000-memory.dmpFilesize
6.5MB
-
memory/1076-80-0x00000000770F0000-0x00000000770F2000-memory.dmpFilesize
8KB
-
memory/1076-83-0x0000000001300000-0x0000000001976000-memory.dmpFilesize
6.5MB
-
memory/1108-55-0x0000000075421000-0x0000000075423000-memory.dmpFilesize
8KB
-
memory/1200-78-0x000000013F230000-0x000000013FBB0000-memory.dmpFilesize
9.5MB
-
memory/1200-77-0x000000013F230000-0x000000013FBB0000-memory.dmpFilesize
9.5MB
-
memory/1200-76-0x000000013F230000-0x000000013FBB0000-memory.dmpFilesize
9.5MB