Analysis
-
max time kernel
90s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2022 19:22
Static task
static1
Behavioral task
behavioral1
Sample
Project info.lnk
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Project info.lnk
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
iyXaimiAupRils.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral4
Sample
iyXaimiAupRils.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
mKvXxKFuXZEtgH.bat
Resource
win7-20220901-en
windows7-x64
General
-
Target
mKvXxKFuXZEtgH.bat
-
Size
977B
-
MD5
0b2981c65f49936014b1f71436375f82
-
SHA1
31e9567584fdd57503e7aa8a54295dd06f24ee26
-
SHA256
ffdd491ffe1256a06149e8f5e04e1863a02319a54d4cd9b8e5b5241267844aab
-
SHA512
9e4dbf211b2f4ea18fcc6bef58ebb5ab37553436884f8a19a30001b95ced510316d2ecc204ad47c1119c4c3b53e0edad6a3400fd6904503f5678ead619ab21b6
Malware Config
Extracted
bumblebee
2009
45.153.241.245:443
195.133.192.117:443
146.70.147.16:443
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Wine rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 3192 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe 3192 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1168 wrote to memory of 3192 1168 cmd.exe 80 PID 1168 wrote to memory of 3192 1168 cmd.exe 80
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mKvXxKFuXZEtgH.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\system32\rundll32.exerundll32 iyXaimiAupRils.dll,runnode2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3192
-