Analysis
- max time kernel
86s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
01/09/2022, 11:01
Static task
static1
Behavioral task
behavioral1
Sample
GfsFepFIKsNGpt.dll
Resource
win7-20220812-en
windows7-x64
General
- Target GfsFepFIKsNGpt.dll
- Size 1.7MB
- Sample220901-m4kdkacfcm
- SHA256 32d3c8a61ba7a61d1f7466a4a60f7b52bb9bb0e6d000418da5cce79831f55a8c
- MD5 14da4c2df839237771865372ce4eee25
- SHA1 5b0c15e551f989d1702478a50da3fac5bd3dff87
- SHA512 dd480f58734d0b5d1b53af599ca665422b1268263bceccd12b9103d95a4554b7b4b781af18eafefc3ba5713ad4cd18ba1513046bad10e7126894bca2761ece17
- SSDEEP 49152:7mWxtD5wWHxLrApxq7pMKEngsfyJllGVeTQKP7:7vxtD66xLrsxIpMKEngsfyJllGVeTQKD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
-
bumblebee
-
3108
-
54.203.130.81:428
-
103.160.22.125:439
-
100.194.5.156:279
-
138.10.128.167:465
-
16.68.199.17:119
-
49.58.238.45:318
-
158.121.21.147:265
-
76.179.109.138:320
-
219.114.206.84:318
-
242.123.229.45:306
-
247.142.48.124:278
-
137.128.84.3:389
-
178.18.89.43:472
-
68.72.230.54:206
-
253.1.172.156:320
-
88.12.127.219:297
-
113.50.222.178:284
-
135.21.140.60:404
-
64.44.102.36:443
-
247.232.101.39:263
-
25.164.199.235:483
-
229.34.16.142:331
-
161.192.84.102:421
-
92.50.58.134:268
-
150.69.136.89:264
-
117.250.45.148:196
-
193.19.186.178:227
-
80.161.122.170:210
-
51.83.249.204:443
-
244.56.215.21:367
-
146.70.106.163:443
-
22.226.202.236:160
-
5.98.161.45:407
-
169.173.118.1:482
-
241.97.45.244:361
-
25.22.207.178:454
-
33.152.14.249:176
-
225.69.64.137:234
-
66.123.133.120:125
-
233.57.245.52:193
-
175.88.206.214:229
-
12.171.4.209:360
-
203.176.214.111:334
-
22.233.59.206:201
-
81.135.6.89:355
-
151.147.0.228:393
-
129.92.194.112:238
-
249.69.235.102:423
-
131.243.196.86:251
-
135.47.154.49:225
-
225.22.137.126:322
-
18.153.76.23:229
-
189.3.235.110:232
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF regsvr32.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ regsvr32.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions regsvr32.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate regsvr32.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1502147629-2175634256-330282290-1000\SOFTWARE\Wine regsvr32.exe - Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 3176 regsvr32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe 3176 regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\GfsFepFIKsNGpt.dll1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3176