Analysis
- max time kernel
91s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
03/06/2022, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
taxep.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target taxep.dll
- Size 1.6MB
- Sample220603-mpdbpsaceq
- SHA256 538d9548d4b197611a07d436feb27beff04e6cd53fba88b1cfdee626eff89db2
- MD5 96311317eb4a91f0919637a0ff9d8798
- SHA1 6ab7f83e5823b0610d9febc184e55ade564bd9ce
- SHA512 71108c7417dcdde59ed89d8cc39d9f4ebc73d9ecc30c81b154ad6b516d1cf5ab8e754a03e0fc56f78577879f6bcfc159e977c030a0584f0bcaf6bf5a1ee5814b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
206r
C2
-
145.239.30.26:443
-
194.37.97.135:443
-
185.62.58.238:443
-
176.107.177.124:443
-
192.236.160.254:443
-
192.236.192.85:443
-
185.62.56.201:443
-
103.175.16.59:443
-
198.98.57.91:443
-
154.56.0.221:443
-
64.44.101.250:443
-
103.175.16.117:443
-
63.141.248.253:443
-
192.236.194.136:443
-
193.239.84.247:443
-
192.236.161.191:443
-
185.156.172.123:443
-
54.38.136.187:443
-
64.44.102.6:443
-
192.119.64.21:443
-
79.110.52.56:443
-
103.175.16.107:443
-
146.19.173.224:443
-
68.233.238.105:443
-
64.44.135.250:443
-
103.175.16.121:443
-
192.236.249.68:443
-
193.239.84.254:443
-
37.120.198.248:443
-
146.19.173.139:443
rc4.plain
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Wine rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe 1100 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\taxep.dll,#11⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:1100