Analysis
-
max time kernel
116s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2022 08:44
Static task
static1
General
-
Target
run.bat
-
Size
67B
-
MD5
88b70022e95f95d40d0db15dfa5645fe
-
SHA1
b115f63938e89369cb3559ab15a963402a656213
-
SHA256
09243b605fb44265e2bd7251ef929986509930171e7bbb7835773ea819342259
-
SHA512
6c8bf631171a91f23f9c237fc8ff5291d13a5f21a29a8332ea83304760ce86beddbdac1396f0467901a4fc1db9ace1517c2b5d1cd65604e1f944602402ba5b91
Malware Config
Extracted
Family
bumblebee
Botnet
0510
C2
51.83.250.102:443
150.125.181.52:443
208.115.216.246:443
192.119.77.44:443
rc4.plain
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Wine rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2112 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe 2112 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2112 1928 cmd.exe 81 PID 1928 wrote to memory of 2112 1928 cmd.exe 81
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\stirring.dll,ctrlrun2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2112
-