Analysis
-
max time kernel
118s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
24/06/2022, 22:36
Static task
static1
Behavioral task
behavioral1
Sample
projectr.dll
Resource
win7-20220414-en
windows7_x64
General
-
Target
projectr.dll
-
Size
1.8MB
-
MD5
996df34af37534606d59b126eafe0dcb
-
SHA1
f1d3f199ee1aa2ff917b76ad41a64a2a6771f198
-
SHA256
1abd17b10f565bbae870ecc1634cd3c15e80f5d001f748bc112d000e67093669
-
SHA512
462de3cb0029777103d1fe93b7fc2f190033f2ac669c48724853d544f532d2f28c6439e7f198fb1e336145f354ef589b0922c355c7eedab2995d1b37604d03a4
Malware Config
Extracted
bumblebee
236a
146.19.173.191:443
205.218.26.106:335
133.228.15.13:127
60.3.192.137:146
146.70.124.97:443
40.178.16.145:137
216.149.130.58:162
121.214.140.226:358
54.200.237.168:311
85.217.238.89:286
23.82.141.11:443
135.49.247.231:357
105.99.153.173:436
226.179.144.85:474
115.177.167.79:268
23.29.115.172:443
242.165.229.167:492
238.78.243.167:401
28.192.253.108:405
82.217.32.8:253
51.164.163.86:229
60.168.159.77:407
111.166.163.223:496
172.93.181.233:443
100.104.205.209:484
232.156.186.23:466
44.182.75.245:332
33.57.182.96:208
185.62.56.129:443
120.228.168.112:306
71.10.1.64:264
19.85.43.167:259
17.59.84.10:180
112.235.192.175:423
51.83.253.131:443
90.67.157.183:121
143.97.115.135:246
170.38.189.154:350
244.79.216.210:311
46.33.217.133:272
162.19.0.125:490
59.68.38.91:440
104.168.201.219:443
167.79.143.101:421
45.153.241.120:443
108.62.118.221:443
242.178.173.56:130
152.89.247.79:443
220.202.94.220:452
87.90.222.97:267
193.107.167.95:228
227.246.217.88:191
35.61.78.73:296
154.56.0.111:443
37.79.217.61:493
130.152.160.174:2
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse regsvr32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ regsvr32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions regsvr32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Wine regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe 1456 regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\projectr.dll1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:1456