Analysis
- max time kernel
91s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
20/05/2022, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
texte.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target texte.dll
- Size 1.3MB
- Sample220520-mxt97aaef5
- SHA256 07edd643a92f1611deb26f28cb1c9182dc525b773d0a3ffd8a4b66f9f39f2917
- MD5 60daaee7208a13f9acd5e168a2ddb2f1
- SHA1 83d932885f93b091f097f1771c482b233ec988e3
- SHA512 7483358e26514f51ae01321445b0f7c19428c928eb356174edddca0b7b270a51e95b2b2bb38bf24e712997b5bf8bb501fc2f7f612fad83378a6d9c31528cbd5a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
1705r
C2
-
176.107.177.124:443
-
192.236.160.254:443
-
192.236.192.85:443
rc4.plain
Signatures
- Enumerates VirtualBox registry keys 2 TTPs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Wine rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe 3936 rundll32.exe