Analysis
-
max time kernel
79s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15/06/2022, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
ScannedDocuments-0622.lnk
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
ScannedDocuments-0622.lnk
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral3
Sample
inf.bat
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral4
Sample
inf.bat
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral5
Sample
information.dll
Resource
win7-20220414-en
windows7_x64
General
-
Target
inf.bat
-
Size
41B
-
MD5
993ea3729ef89775410c1f8a5e4a468f
-
SHA1
3f5b69eb4d54ee92493f211e13ffb89cda914650
-
SHA256
1e78385d81b5177c733c7e2ed2f91d5400fd526c786cac089aef6e6f6ec2f08e
-
SHA512
14564f14807a341b161a753da27af790275e2dd0803c37c294c52d8882962ab0f774775417a80beacef4fb07cc36cc683077622d5851b5733005791a5d3abdff
Malware Config
Extracted
bumblebee
146l
242.165.212.79:339
162.144.249.150:239
63.122.120.151:268
144.52.138.51:193
18.215.29.142:436
115.239.67.202:380
255.11.235.99:426
213.203.201.199:307
143.117.20.123:425
141.98.168.70:443
174.150.214.40:426
133.133.249.24:204
126.68.7.249:422
103.175.16.107:443
146.70.124.77:443
154.56.0.100:443
180.184.129.160:223
28.78.74.145:427
108.28.254.44:399
115.103.22.1:153
149.57.112.159:122
229.139.73.188:287
112.110.146.153:349
249.222.51.70:286
180.23.251.29:230
244.234.60.83:386
79.133.212.60:211
192.21.12.118:231
31.215.170.180:431
140.208.107.161:360
119.177.224.146:124
58.10.55.201:382
57.156.134.113:446
83.142.26.147:465
194.135.33.16:443
35.17.203.69:268
104.135.8.250:417
210.251.188.194:228
53.96.32.99:333
70.77.209.88:224
65.254.82.66:498
65.95.20.151:232
165.158.204.41:469
185.62.58.209:443
102.109.16.255:445
137.253.55.69:235
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Wine rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe 1000 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1000 3068 cmd.exe 85 PID 3068 wrote to memory of 1000 3068 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\inf.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\system32\rundll32.exerundll32 information.dll,hKOgtkmCis2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:1000
-