Analysis
-
max time kernel
40s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
15-09-2022 11:28
General
-
Target
9n3.dll
-
Size
2.5MB
-
MD5
7c3eacc5af118753850b18ed37aec4fd
-
SHA1
15e1cd059e3cb6d6e63bd2c7718844b917f42705
-
SHA256
3ecd8e4cab18d088b8394b6880fb00e6d17d8fe19ba2b0f7f7abd9cb738a3f54
-
SHA512
db731a0a387e8cecc499ef90415ddee213526f4fffe2fc0394855b77b1602f2cfbd0817031a1bc47d8650d84e0268baeb27f3ffdd72a1ab26c52080b664e6a09
-
SSDEEP
49152:EY8+6OwVQpMQ08Fk1BGrXN3fLXZOMU9EeF2gYNpJsv9:Eg6OXp0KC0rXptVeum
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
VPS1
C2
45.147.229.23:443
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9n3.dll,#11⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB