Analysis
- max time kernel
90s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
29/06/2022, 16:35
Static task
static1
Behavioral task
behavioral1
Sample
stats.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target stats.dll
- Size 1.4MB
- Sample220629-t3m7dsbbbl
- SHA256 0a1f783975c84eb09e79a4c0c984ec8a9aa4de8deeb3b03bec3877bf4629bae5
- MD5 fedf94189d8864feba90916b94376a80
- SHA1 7f42b71a953192dda0a4a98fceff62a7a2ae4409
- SHA512 df3082f4fed85d906406955b1f66cdb32cea99f1d959df2a983499321dd055456a19a1f9006ca5f6bf1421a2f296fab79cb2e46949674af655b55d981cc942f5
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
276l
C2
-
172.93.193.124:443
-
45.153.241.64:443
-
45.153.241.19:443
rc4.plain
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService regsvr32.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ regsvr32.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions regsvr32.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate regsvr32.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Wine regsvr32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe 4120 regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\stats.dll1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:4120