Analysis
-
max time kernel
91s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17/06/2022, 23:01
Static task
static1
Behavioral task
behavioral1
Sample
project.dll
Resource
win7-20220414-en
windows7_x64
General
-
Target
project.dll
-
Size
1.5MB
-
MD5
5aff7450b8d4ae74590438fd97cf73f6
-
SHA1
ed215a6cca274ba5d0707436b6da9a23e52fcdfa
-
SHA256
dfa2adde1ed8dbf9e5ae585342325b9c1fd84e9d675bf54bc7b21db07b14f589
-
SHA512
fe86d3f51ca925dcb804c8a0d32033776a02a2e38426c16d6783f45941265e88ee9658bf9b397982e0cca3a9f3154f1c8ca97118a2b06cbac33d7d5ac90cc53f
Malware Config
Extracted
bumblebee
156a
83.47.40.251:306
251.143.69.150:395
64.250.120.4:406
115.16.153.155:459
233.82.38.10:391
60.27.170.3:463
221.218.33.190:154
218.199.149.25:415
0.134.23.62:116
241.41.90.117:181
78.244.227.62:462
146.70.125.122:443
224.49.28.61:214
2.97.24.126:148
112.81.173.199:399
170.107.238.10:276
45.84.0.13:443
210.163.58.211:385
146.19.173.186:443
154.56.0.102:443
168.20.103.16:132
51.210.158.156:443
193.43.251.231:312
135.142.208.39:298
9.240.112.25:411
155.113.182.180:324
174.58.225.25:420
208.151.241.134:362
228.127.34.30:316
178.255.155.53:108
30.65.48.152:239
135.36.13.40:427
117.50.181.41:373
213.26.162.157:477
78.174.92.106:151
114.9.152.233:402
1.32.39.22:459
224.255.62.16:414
45.3.236.177:312
185.62.56.202:443
251.210.76.59:335
120.237.172.163:343
32.181.245.23:191
79.198.114.179:442
242.30.221.68:198
95.29.177.99:462
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService regsvr32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ regsvr32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions regsvr32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate regsvr32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Wine regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe 1760 regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\project.dll1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:1760