Analysis
-
max time kernel
92s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16/06/2022, 16:12
Static task
static1
Behavioral task
behavioral1
Sample
information.dll
Resource
win7-20220414-en
windows7_x64
General
-
Target
information.dll
-
Size
2.0MB
-
MD5
c9216484a6371b055705ec5f4098ab01
-
SHA1
a13903e50408e11996159fba5f7deab1e73e8f08
-
SHA256
fed9bc8df9141f8f8f7a9203bc26b5b22123c154702fcd625379f2f7ecd31cb2
-
SHA512
64485bb8e1845a29f9d60343a0bd6fd8de4220aa83f3cd19eed47737642b79db2753106192798d495202e74016f2e845d161c1362ad09b01104f9cfb8c939359
Malware Config
Extracted
bumblebee
146l
242.165.212.79:339
162.144.249.150:239
63.122.120.151:268
144.52.138.51:193
18.215.29.142:436
115.239.67.202:380
255.11.235.99:426
213.203.201.199:307
143.117.20.123:425
141.98.168.70:443
174.150.214.40:426
133.133.249.24:204
126.68.7.249:422
103.175.16.107:443
146.70.124.77:443
154.56.0.100:443
180.184.129.160:223
28.78.74.145:427
108.28.254.44:399
115.103.22.1:153
149.57.112.159:122
229.139.73.188:287
112.110.146.153:349
249.222.51.70:286
180.23.251.29:230
244.234.60.83:386
79.133.212.60:211
192.21.12.118:231
31.215.170.180:431
140.208.107.161:360
119.177.224.146:124
58.10.55.201:382
57.156.134.113:446
83.142.26.147:465
194.135.33.16:443
35.17.203.69:268
104.135.8.250:417
210.251.188.194:228
53.96.32.99:333
70.77.209.88:224
65.254.82.66:498
65.95.20.151:232
165.158.204.41:469
185.62.58.209:443
102.109.16.255:445
137.253.55.69:235
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Wine rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe 2912 rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\information.dll,#11⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:2912