Analysis
-
max time kernel
81s -
max time network
147s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
25/06/2022, 07:39
Static task
static1
Behavioral task
behavioral1
Sample
bumblebee_2.dll
Resource
win10-20220414-en
windows10_x64
General
-
Target
run.bat
-
Size
60B
-
MD5
60eedc41b3d76619d754db548ffa3dfb
-
SHA1
5a44fa68e70c58d3231c520587c9bcb84c4c628f
-
SHA256
be577c73a4e501f63ab1a43f7fe5fa50b276c55491c39b57c756da834e2be493
-
SHA512
402c41938af3960533fcb3ade77fd410c50e0e4b97e914cff02a81a3c22e80f35d263c28385eabcb9275d30660da0678fc4400f7f01036295f9622d946486ff2
Malware Config
Extracted
bumblebee
236r
54.38.136.111:443
103.200.32.188:492
74.57.128.223:112
13.2.200.200:338
228.194.82.251:473
247.224.208.140:372
0.151.228.146:282
192.119.77.241:443
186.150.217.235:221
50.41.225.93:478
50.167.186.112:239
173.77.219.120:201
187.210.45.242:299
239.11.133.48:421
207.6.99.3:471
98.28.11.39:201
193.239.152.108:242
133.209.39.126:217
146.19.173.202:443
97.194.155.116:446
86.91.101.57:221
101.8.100.194:131
152.38.148.148:494
89.172.3.185:315
138.114.199.166:316
69.120.31.126:408
74.135.94.210:347
204.233.101.71:459
168.120.139.16:273
204.181.129.183:248
172.110.248.55:203
25.170.215.18:456
82.20.113.198:446
106.120.29.13:489
246.47.222.240:216
103.175.16.47:443
24.121.25.160:346
28.53.120.108:270
211.131.243.77:112
246.232.135.28:477
49.179.166.100:235
146.19.173.207:443
206.103.180.253:205
215.48.4.118:123
224.239.200.236:443
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3297182285-798020602-2032295036-1000\SOFTWARE\Wine rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe 2412 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2412 1932 cmd.exe 67 PID 1932 wrote to memory of 2412 1932 cmd.exe 67
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bumblebee_2.dll,PjyJGGCvQs2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:2412
-