Overview

overview

10

Static

static

ccde5e528a...95.dll

windows7_x64

10

ccde5e528a...95.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    41s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    14/06/2022, 11:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ccde5e528a8da994b3cd96a988023acd16a78a9cea4fe5dc1b41d9a72890a995.dll

  • Size

    1.4MB

  • MD5

    ccd45fd7136d6c54e31d1703164fa855

  • SHA1

    e71645b6a0d82b0c3a1c7326e07140a8333229b3

  • SHA256

    ccde5e528a8da994b3cd96a988023acd16a78a9cea4fe5dc1b41d9a72890a995

  • SHA512

    f254c19b8c6cab02b277833d8b4b96ae7182d22e3a4d580780fd3e3f1d1c8392430f0431cf8d0f27504e3b8faf88b0372947279fabce921f09191624dabff104

Score
10/10
bumblebeea10evasiontrojan

Malware Config

Extracted

Family

bumblebee

Botnet

a10

C2

45.153.240.155:443

142.11.196.174:443

54.37.130.166:443

146.70.95.244:443

185.62.57.19:443

45.153.240.139:443

103.144.139.18:443

51.68.147.233:443

185.62.56.128:443

51.83.251.245:443

185.62.56.21:443

154.56.0.236:443

104.168.164.153:443

193.27.14.242:443

146.70.53.183:443

146.19.253.15:443

160.20.147.191:443

79.110.52.236:443

37.72.174.23:443

64.44.135.230:443
rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Suspicious behavior: EnumeratesProcesses 41 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ccde5e528a8da994b3cd96a988023acd16a78a9cea4fe5dc1b41d9a72890a995.dll,#1
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious behavior: EnumeratesProcesses
    PID:1468

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1468-54-0x0000000002510000-0x0000000002627000-memory.dmp

    Filesize

    1.1MB

    Download