Analysis
-
max time kernel
62s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2022 16:01
Static task
static1
General
-
Target
run.bat
-
Size
71B
-
MD5
6591003f2457cf895f742d17568406e8
-
SHA1
932cb57597a6c1fd06a807300e0f1cea9f49b600
-
SHA256
57ca398e9f0210ed459827c01ab10574626693873ae3e1ff6acf2f635caab2b2
-
SHA512
10c0ab917cfe6f8432ab291a44eda0a0cf47a1800030fc40984a3d8e0955f0367625bb0288aa10ed341fd12f35dbd7b7b05b602aa7f22d10257c05fca17669a2
Malware Config
Extracted
Family
bumblebee
Botnet
0510
C2
51.83.250.102:443
150.125.181.52:443
208.115.216.246:443
192.119.77.44:443
rc4.plain
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Wine rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 3692 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe 3692 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4908 wrote to memory of 3692 4908 cmd.exe 82 PID 4908 wrote to memory of 3692 4908 cmd.exe 82
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\overpowering.dll,ctrlrun2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3692
-