Analysis
- max time kernel
92s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
16/06/2022, 16:12
Static task
static1
Behavioral task
behavioral1
Sample
information.dll
Resource
win7-20220414-en
windows7_x64
General
- Target information.dll
- Size 2.0MB
- Sample220616-tng2tsfhfl
- SHA256 fed9bc8df9141f8f8f7a9203bc26b5b22123c154702fcd625379f2f7ecd31cb2
- MD5 c9216484a6371b055705ec5f4098ab01
- SHA1 a13903e50408e11996159fba5f7deab1e73e8f08
- SHA512 64485bb8e1845a29f9d60343a0bd6fd8de4220aa83f3cd19eed47737642b79db2753106192798d495202e74016f2e845d161c1362ad09b01104f9cfb8c939359
- MD5 SHA1 SHA512
Malware Config
Extracted
-
bumblebee
-
146l
-
242.165.212.79:339
-
162.144.249.150:239
-
63.122.120.151:268
-
144.52.138.51:193
-
18.215.29.142:436
-
115.239.67.202:380
-
255.11.235.99:426
-
213.203.201.199:307
-
143.117.20.123:425
-
141.98.168.70:443
-
174.150.214.40:426
-
133.133.249.24:204
-
126.68.7.249:422
-
103.175.16.107:443
-
146.70.124.77:443
-
154.56.0.100:443
-
180.184.129.160:223
-
28.78.74.145:427
-
108.28.254.44:399
-
115.103.22.1:153
-
149.57.112.159:122
-
229.139.73.188:287
-
112.110.146.153:349
-
249.222.51.70:286
-
180.23.251.29:230
-
244.234.60.83:386
-
79.133.212.60:211
-
192.21.12.118:231
-
31.215.170.180:431
-
140.208.107.161:360
-
119.177.224.146:124
-
58.10.55.201:382
-
57.156.134.113:446
-
83.142.26.147:465
-
194.135.33.16:443
-
35.17.203.69:268
-
104.135.8.250:417
-
210.251.188.194:228
-
53.96.32.99:333
-
70.77.209.88:224
-
65.254.82.66:498
-
65.95.20.151:232
-
165.158.204.41:469
-
185.62.58.209:443
-
102.109.16.255:445
-
137.253.55.69:235
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Wine rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\information.dll,#11⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:2912