Overview

overview

10

Static

static

run.bat

windows7_x64

10

Analysis

  • max time kernel
    37s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    09/06/2022, 05:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    run.bat

  • Size

    77B

  • MD5

    3ac55d9620e3ad3c0a3d3eb9a39fe173

  • SHA1

    2a182584af31414c76434f26568f9d49fbe33da8

  • SHA256

    3ac53d1fc124f794da914e7c2c6baa006beba4e87fa9f1656ef22465c61b1e28

  • SHA512

    a09bfa6761c0acb515c452732ee4e6d02185a0e0b8c342c76f63b391e8a92711d7e6ee9c28219b8695e7fa60a313b8b900164e3255dcd9338835185e79e38f28

Score
10/10
bumblebee8aevasiontrojan

Malware Config

Extracted

Family

bumblebee

Botnet

8a

C2

45.153.240.155:443

142.11.196.174:443

54.37.130.166:443

146.70.95.244:443

185.62.57.19:443

45.153.240.139:443

103.144.139.18:443

51.68.147.233:443

185.62.56.128:443

51.83.251.245:443

185.62.56.21:443

154.56.0.236:443

104.168.164.153:443

193.27.14.242:443

146.70.53.183:443

146.19.253.15:443

160.20.147.191:443

79.110.52.236:443

37.72.174.23:443

64.44.135.230:443
rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\run.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\requirements.dll,InitHelperDll
      2⤵
      • Enumerates VirtualBox registry keys
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Looks for VirtualBox Guest Additions in registry
      • Checks BIOS information in registry
      • Identifies Wine through registry keys
      • Suspicious behavior: EnumeratesProcesses
      PID:1072

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1072-55-0x0000000002520000-0x0000000002637000-memory.dmp

    Filesize

    1.1MB

    Download