Overview

overview

10

Static

static

54dee3dd5f...b1.dll

windows7-x64

3

54dee3dd5f...b1.dll

windows10-2004-x64

10

Resubmissions

06-10-2022 12:56

221006-p6exzahfem 10

06-10-2022 12:52

221006-p4h7lshde3 3

19-09-2022 16:57

220919-vggcdshdf9 3

Analysis

  • max time kernel
    82s
  • max time network
    66s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-10-2022 12:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    54dee3dd5f14aba8b0d62ceaa419a777a3f1f070b49767f6545a2729ab65d3b1.dll

  • Size

    3.6MB

  • MD5

    77e5ff1e4eff690fdcc6e0ba9877e1e6

  • SHA1

    721b9448b4e54046e156b8ad3b35a8833ecd5daf

  • SHA256

    54dee3dd5f14aba8b0d62ceaa419a777a3f1f070b49767f6545a2729ab65d3b1

  • SHA512

    dd853f675de53ae50ea1618c097a2acf2c332c9eb35efefbe6e2dc56eaf16b7ef4bde5f496fe3c16ec1a877cbd0865600ce78ee378a30f37bb9df010511cb686

  • SSDEEP

    24576:6uMZRLX8+gpL/+2thqiWjJa9cRXtdN86CHXuPVvDVHBXVWcs+lwWTAYq3/ny1Ow+:6jZJ8+gpL/hWjoe

Score
10/10
bumblebee1909evasiontrojan

Malware Config

Extracted

Family

bumblebee

Botnet

1909

C2

108.177.235.29:443

23.106.160.117:443

23.106.215.133:443
rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\54dee3dd5f14aba8b0d62ceaa419a777a3f1f070b49767f6545a2729ab65d3b1.dll,#1
    1⤵
      PID:2144
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2144 -s 328
        2⤵
        • Program crash
        PID:1684
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 408 -p 2144 -ip 2144
      1⤵
        PID:4244
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:3484
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4280
          • C:\Windows\system32\rundll32.exe
            rundll32.exe 54dee3dd5f14aba8b0d62ceaa419a777a3f1f070b49767f6545a2729ab65d3b1.dll,CreateTask
            2⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Looks for VirtualBox Guest Additions in registry
            • Checks BIOS information in registry
            • Identifies Wine through registry keys
            • Suspicious use of NtCreateThreadExHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:3788
        • C:\Windows\system32\osk.exe
          "C:\Windows\system32\osk.exe"
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:3768
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x304 0x300
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4728

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3788-133-0x000001824DEB0000-0x000001824E00F000-memory.dmp

          Filesize

          1.4MB

          Download