Analysis
-
max time kernel
91s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15/06/2022, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
glin3r/documents.lnk
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
glin3r/documents.lnk
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral3
Sample
glin3r/glin3r.dll
Resource
win7-20220414-en
windows7_x64
General
-
Target
glin3r/documents.lnk
-
Size
2KB
-
MD5
0c61c063804dbbe46b16acbfb28d8771
-
SHA1
1231e3cddeedc09bb243b9b4536f3029efc4c8b7
-
SHA256
7b9a00cbd523a9585abb072f782b0b1447a905a3d63232627591bdf363f776c4
-
SHA512
6c2a29ba06bda9b778e2590d45ba698bc7b195c014afd31ede17ce086786413b97d8c9c7f29b38e07022571e0a397d44cad01550fb5a673014246c21a350e35b
Malware Config
Extracted
bumblebee
156r
249.241.29.24:181
124.243.81.221:274
142.11.216.143:443
190.123.237.229:261
208.84.180.22:146
103.175.16.106:443
18.8.71.243:176
37.64.220.2:332
100.93.33.185:487
182.62.4.186:282
239.100.121.57:329
228.78.147.191:253
212.234.34.219:148
138.65.77.29:391
55.14.133.44:292
221.238.146.116:272
91.167.137.83:421
66.23.70.38:168
183.37.64.159:220
241.112.226.151:197
253.174.222.210:447
78.90.18.29:383
185.94.100.232:189
208.231.162.191:266
0.42.131.123:144
49.57.156.149:228
103.175.16.107:443
109.108.10.35:386
177.231.94.146:410
78.79.38.95:496
231.169.5.102:403
141.98.168.70:443
45.153.241.234:443
238.42.54.122:171
194.135.33.16:443
26.6.83.53:219
241.54.78.154:269
3.172.226.46:189
203.138.139.122:404
80.241.131.170:311
132.44.27.212:299
146.19.173.105:443
213.115.131.233:186
222.62.166.76:206
127.87.0.227:339
2.190.89.140:236
98.84.87.52:353
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation cmd.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Wine rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe 2060 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2652 wrote to memory of 2060 2652 cmd.exe 83 PID 2652 wrote to memory of 2060 2652 cmd.exe 83
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\glin3r\documents.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" glin3r.dll,REZNavuTXR2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:2060
-