Analysis
-
max time kernel
91s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2022 20:11
Static task
static1
Behavioral task
behavioral1
Sample
bhaks.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
bhaks.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
exit.bat
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
exit.bat
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
required information.lnk
Resource
win7-20220812-en
windows7-x64
General
-
Target
exit.bat
-
Size
926B
-
MD5
ac5ac9522b475f3f9ffe4ff760d214b9
-
SHA1
a684c4618a78590ff572f4009e78829052f63dd8
-
SHA256
67b38543ed6ba39a442d1563cbae37b6c6cb27679ddf62804a720b4fd8af6873
-
SHA512
1001cf2e6780c913398825a7ee4e42ac983203fc9e6e100528f2996411028bc9d6a5396e71229a1df0755c22610d6d66b0713cf21b92b04ec20715bcc08a9648
Malware Config
Extracted
bumblebee
1209
103.144.139.138:443
154.56.0.119:443
158.20.4.234:443
205.185.123.115:443
146.70.143.140:443
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Wine rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1172 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe 1172 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4824 wrote to memory of 1172 4824 cmd.exe 81 PID 4824 wrote to memory of 1172 4824 cmd.exe 81
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\exit.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\system32\rundll32.exerundll32 bhaks.dll,vcsfile2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1172
-