Analysis
-
max time kernel
92s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
27/06/2022, 18:17
Static task
static1
Behavioral task
behavioral1
Sample
Project Requirements.lnk
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral2
Sample
Project Requirements.lnk
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral3
Sample
file.dll
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral4
Sample
file.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
Behavioral task
behavioral5
Sample
file.rsp
Resource
win7-20220414-en
windows7_x64
Behavioral task
behavioral6
Sample
file.rsp
Resource
win10v2004-20220414-en
windows10-2004_x64
General
-
Target
file.dll
-
Size
1.3MB
-
MD5
2dcdc650159b4147ab3eba65800cf553
-
SHA1
53658de68b22b1ca5707ab99e9178b75a7320427
-
SHA256
921f3bfa1f2c1397a749a336c9fb77243932d20eac2a0812348727e5ac83aefa
-
SHA512
cc30d88a7fc26333d71dbd53fb1e7c54de3069efdaa67947c103030b60c1d13716c37cfde48eb7fae2dc556efb5b29de1e37fc23585055e14940380bf1c9008b
Malware Config
Extracted
bumblebee
246a
231.215.229.228:485
69.52.231.230:347
239.99.55.244:383
128.197.89.141:438
100.75.172.149:488
23.82.141.11:443
107.77.228.163:260
88.232.241.45:176
51.83.253.131:443
80.194.203.32:143
18.248.93.197:110
200.194.145.202:359
154.56.0.111:443
154.207.124.132:129
174.104.34.167:296
84.224.237.39:382
195.250.7.94:370
237.251.89.198:174
81.39.2.175:407
139.203.193.38:443
26.244.227.146:252
162.153.29.31:408
109.114.164.56:341
164.139.191.188:200
138.25.64.130:123
172.93.181.233:443
180.41.21.242:460
36.182.116.222:246
169.2.3.200:122
157.31.84.224:404
152.89.247.79:443
29.115.76.46:471
126.223.165.184:300
7.250.39.253:268
45.57.247.90:166
143.129.93.204:167
137.221.82.177:278
45.153.241.120:443
188.58.77.247:324
104.168.201.219:443
146.216.213.168:174
229.23.130.16:219
238.236.217.49:203
231.86.39.110:288
23.29.115.172:443
229.200.15.68:122
45.70.108.7:247
35.144.67.161:126
226.123.11.152:117
196.43.6.18:433
49.120.55.118:127
131.177.169.190:413
197.189.37.228:175
185.62.56.129:443
143.123.88.53:124
146.70.124.97:44
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo regsvr32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ regsvr32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions regsvr32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Wine regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe 3880 regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\file.dll1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:3880