Overview

overview

10

Static

static

oFWkRTFwjm.zip

windows10-2004_x64

10

documents.lnk

windows10-2004_x64

10

lipes.dll

windows10-2004_x64

10

Resubmissions

10-10-2022 17:13

221010-vrjkhacggj 10

03-06-2022 21:56

220603-1tra1seah3 1

03-06-2022 21:55

220603-1swt4sabgp 1

03-06-2022 21:38

220603-1hbq7adhf4 10

03-06-2022 21:28

220603-1brttsdha7 10

Analysis

  • max time kernel
    598s
  • max time network
    646s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    03-06-2022 21:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    lipes.dll

  • Size

    1.5MB

  • MD5

    9ef37bfa9f7e30500ad9edf136ee59d1

  • SHA1

    7b31d4ec43c65666f2e08bb73ec7877cf74d34a0

  • SHA256

    a1040e1d6b43eda731179d139f76949afb962b8cb28c55f4097cf5a5c6c445c1

  • SHA512

    1a52c2bb2775476a14220f79483582b5b09a310fcc5b017df8482ad3e5a0fb6438e28ae23da4cc76e6f05972ccec0d077065dcbd8d8d219d5897250ce38393bd

Score
10/10
bumblebee106revasiontrojan

Malware Config

Extracted

Family

bumblebee

Botnet

106r

C2

144.19.20.11:443

150.27.81.2:443

46.21.153.145:443

109.45.29.202:443

6.30.139.246:443

236.110.58.103:443

36.110.58.103:443

149.255.35.134:443

9.63.15.101:443

45.147.229.50:443

184.23.74.168:443

139.24.56.111:443

243.45.135.100:443

21.246.85.34:443

79.44.167.23:443

30.17.4.146:443

56.134.87.45:443

16.46.4.333:443

224.145.6.33:443
rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Enumerates VirtualBox registry keys 2 TTPs 10 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\lipes.dll,#1
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious behavior: EnumeratesProcesses
    PID:2684
  • C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\system32\rundll32.exe
      C:\Windows\system32\rundll32.exe lipes.dll,oFWkRTFwjm
      2⤵
      • Enumerates VirtualBox registry keys
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Looks for VirtualBox Guest Additions in registry
      • Checks BIOS information in registry
      • Identifies Wine through registry keys
      PID:4488

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2684-130-0x000002A9C4B70000-0x000002A9C4C87000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2684-131-0x00007FFF1B3C0000-0x00007FFF1B3D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4488-133-0x0000019E5C0E0000-0x0000019E5C1F7000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/4488-134-0x00007FFF1B3C0000-0x00007FFF1B3D0000-memory.dmp

    Filesize

    64KB

    Download