Overview

overview

10

Static

static

project re...ts.lnk

windows7_x64

10

project re...ts.lnk

windows10-2004_x64

10

start.dll

windows7_x64

10

start.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    47s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    17/06/2022, 14:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    project requirements.lnk

  • Size

    1KB

  • MD5

    edda66bc860d630aaab6af733006a2c5

  • SHA1

    900bf9e8428fac53bf932b2af2bd4a87c745c413

  • SHA256

    d423bf5e25a80f24161fce6d9b9cc8698f5b63106c1470f0ebdfaae5882d50b0

  • SHA512

    15b0556a1ef3c5d3aaddc8345b237423839a24acb4f8a260adb0b2b4d34f7e6e2d9e92b5f420e18dd04dfcf51b6b1c570073a1d27527a076a0289f86fc449400

Score
10/10
bumblebee166aevasiontrojan

Malware Config

Extracted

Family

bumblebee

Botnet

166a

C2

85.239.33.172:443

25.5.198.104:440

223.31.110.102:393

213.226.100.95:443

25.181.64.39:236

199.193.159.46:283

45.138.172.246:443

84.250.88.57:386

145.244.80.29:230

133.17.128.73:319

14.102.170.127:377

1.39.166.217:166

14.40.68.19:391

146.19.173.186:443

199.201.12.90:201

212.110.132.77:289

69.38.43.160:207

131.169.248.28:201

141.178.39.245:323

28.148.236.16:485
rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\project requirements.lnk"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Windows\System32\odbcconf.exe
      "C:\Windows\System32\odbcconf.exe" -f project.rsp
      2⤵
      • Enumerates VirtualBox registry keys
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Looks for VirtualBox Guest Additions in registry
      • Checks BIOS information in registry
      • Identifies Wine through registry keys
      • Suspicious behavior: EnumeratesProcesses
      PID:2024

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1836-54-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2024-92-0x00000000022B0000-0x00000000023C7000-memory.dmp

    Filesize

    1.1MB

    Download