Overview

overview

10

Static

static

d4884f6b83...aa.dll

windows7_x64

10

d4884f6b83...aa.dll

windows10-2004_x64

10

Analysis

  • max time kernel
    40s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    28/06/2022, 19:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d4884f6b83fef3545c2f884ac137d3e61220a4f79715f0b26a59c6391cee2daa.dll

  • Size

    1.8MB

  • MD5

    37a9209bf12ad28131c5ea44c7c01d4a

  • SHA1

    6346f7020e77ecf1c3484b00515a32ae0ff6e0c1

  • SHA256

    d4884f6b83fef3545c2f884ac137d3e61220a4f79715f0b26a59c6391cee2daa

  • SHA512

    85adb437fe39756d96182378325763226ef8ba97fe57f9072398992ca186d8b7829c90e0178b7ae8995cd7b952450801b43a76a117fec623cc58149f184b938b

Score
10/10
bumblebee236aevasiontrojan

Malware Config

Extracted

Family

bumblebee

Botnet

236a

C2

146.19.173.191:443

205.218.26.106:335

133.228.15.13:127

60.3.192.137:146

146.70.124.97:443

40.178.16.145:137

216.149.130.58:162

121.214.140.226:358

54.200.237.168:311

85.217.238.89:286

23.82.141.11:443

135.49.247.231:357

105.99.153.173:436

226.179.144.85:474

115.177.167.79:268

23.29.115.172:443

242.165.229.167:492

238.78.243.167:401

28.192.253.108:405

82.217.32.8:253
rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Suspicious behavior: EnumeratesProcesses 41 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\d4884f6b83fef3545c2f884ac137d3e61220a4f79715f0b26a59c6391cee2daa.dll
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious behavior: EnumeratesProcesses
    PID:1472

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1472-54-0x000007FEFB971000-0x000007FEFB973000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1472-55-0x00000000024C0000-0x00000000025D6000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1472-57-0x00000000024C0000-0x00000000025D6000-memory.dmp

    Filesize

    1.1MB

    Download