Analysis
-
max time kernel
99s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
17/06/2022, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
project requirements.lnk
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
project requirements.lnk
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral3
Sample
start.dll
Resource
win7-20220414-en
windows7_x64
General
-
Target
start.dll
-
Size
1.8MB
-
MD5
ce8aa596ab8c1d075439a9ee29a438c6
-
SHA1
415ad86787a40abb95fb67e604aba8a075a41ead
-
SHA256
18aed3582da2419ab339bff7d1e84b1eac88d5c9bfaf7320daafcfbb6f6798b3
-
SHA512
a5c7d3b9d127bc1ab22a8a8596a6853ae721fb3286e0b3d5d6592d9be603f1ec31055b7598aad4c9e5ee8adb351a122f12605aa4d76a3842ace8f01645f7af1c
Malware Config
Extracted
bumblebee
166a
85.239.33.172:443
25.5.198.104:440
223.31.110.102:393
213.226.100.95:443
25.181.64.39:236
199.193.159.46:283
45.138.172.246:443
84.250.88.57:386
145.244.80.29:230
133.17.128.73:319
14.102.170.127:377
1.39.166.217:166
14.40.68.19:391
146.19.173.186:443
199.201.12.90:201
212.110.132.77:289
69.38.43.160:207
131.169.248.28:201
141.178.39.245:323
28.148.236.16:485
183.91.36.206:369
7.233.9.154:168
206.131.11.214:414
98.196.25.145:368
126.6.22.125:214
23.254.217.222:443
45.84.0.13:443
90.21.237.13:395
246.154.29.229:449
113.66.39.194:420
14.163.179.250:420
188.231.189.21:153
118.169.209.254:101
233.145.248.254:488
211.17.15.55:327
12.153.80.238:153
125.48.108.197:171
45.142.214.120:443
103.0.111.142:267
163.193.25.54:420
155.50.196.216:294
83.34.167.175:116
178.137.191.220:411
78.94.31.59:119
182.76.20.26:437
145.239.28.110:443
82.21.111.25:490
106.194.193.254:359
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo regsvr32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ regsvr32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions regsvr32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate regsvr32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Wine regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe 1640 regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\start.dll1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:1640