Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

Project re...ts.lnk

windows7_x64

10

Project re...ts.lnk

windows10-2004_x64

10

prjct.dll

windows7_x64

10

prjct.dll

windows10-2004_x64

10

prjct.rsp

windows7_x64

3

prjct.rsp

windows10-2004_x64

3

Resubmissions

13/10/2022, 05:26

221013-f44zmsagfm 10

13/10/2022, 05:21

221013-f2ft2abae7 1

05/07/2022, 20:58

220705-zsep6achfq 10

Analysis

  • max time kernel
    91s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    05/07/2022, 20:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    prjct.dll

  • Size

    1.5MB

  • MD5

    dd9751f48c134f502d5a7a5b39b482be

  • SHA1

    d7ecfa85e28318bd0179d321be7d32c468fc9dae

  • SHA256

    cbef35e0d91b5f169a3bd617c9ebcb3ea025439cb98e3d4a7dbeed4be65b6ef2

  • SHA512

    381889e149f2b49a50f312c47e1e42cefd7bb5eb79013b2ff3213b5161160015f7f75d6b3d4d4f9b07a303599e904433a271fdcada8255e7deb229e8ad6dc6b9

Score
10/10
bumblebee407aevasiontrojan

Malware Config

Extracted

Family

bumblebee

Botnet

407a

C2

106.30.10.152:200

159.107.119.196:466

249.250.158.148:322

202.77.46.110:494

34.34.152.166:165

244.76.41.194:324

134.179.38.71:422

103.175.16.49:443

16.249.204.133:158

231.217.204.87:289

165.84.157.60:302

209.198.142.251:182

78.0.144.134:330

117.17.41.72:459

126.76.167.19:201

217.8.253.10:398

209.141.41.46:443

18.151.45.13:359

97.85.151.94:372

221.184.92.249:392
rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\prjct.dll
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtCreateThreadExHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:1408

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1408-130-0x0000000002BD0000-0x0000000002CE6000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1408-131-0x0000000002BD0000-0x0000000002CE6000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1408-132-0x0000000002BD0000-0x0000000002CE6000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/1408-133-0x00007FFCD51E0000-0x00007FFCD51F0000-memory.dmp

    Filesize

    64KB

    Download