Overview

overview

10

Static

static

Invoice_un...03.iso

windows7-x64

3

Invoice_un...03.iso

windows10-2004-x64

10

Resubmissions

09/10/2022, 13:56

221009-q8rj8ahbhr 10

09/10/2022, 13:55

221009-q78r4shbhn 3

09/10/2022, 13:38

221009-qxcxpahad5 3

07/10/2022, 14:03

221007-rct6xachbp 3

Analysis

  • max time kernel
    90s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2022, 13:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice_unpaid#4103.iso

  • Size

    2.8MB

  • MD5

    6bb0a020774dcc2f7420ad78148edb97

  • SHA1

    9d44941088da4c1c88900f012a07ec7b5ed3ef55

  • SHA256

    3447ba5b8c816bf1f1429b2f130603efcb7b5d4b3bc004f4694dc2fb68ec9780

  • SHA512

    0c1dabe119488ceec631d58a6f76c80ec9add19c51fd0d00538ffe4231395eaf363501959ac998e22e23a6934b12a820ea22aa69e5869c657b23109e669d1c89

  • SSDEEP

    49152:CCP/6PLKTZLk+qM/6ZakaGs810EntI9mHchyN1fPan8/v4y9:N20v/wSU1082mHzpPan0

Score
10/10
bumblebee0610evasiontrojan

Malware Config

Extracted

Family

bumblebee

Botnet

0610

C2

45.147.231.156:443

208.115.216.246:443

23.29.115.164:443

45.61.186.18:443

51.83.250.102:443

192.119.77.44:443
rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Invoice_unpaid#4103.iso
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4328
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1504
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "E:\8720\7237.js"
      1⤵
      • Checks computer location settings
      • Enumerates connected drives
      • Suspicious use of WriteProcessMemory
      PID:384
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""E:\8720\2789.cmd" rund ll3 2"
        2⤵
        • Enumerates connected drives
        • Suspicious use of WriteProcessMemory
        PID:3696
        • C:\Windows\system32\rundll32.exe
          rundll32 8720\pardons.dat,CreateEvent
          3⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Looks for VirtualBox Guest Additions in registry
          • Checks BIOS information in registry
          • Identifies Wine through registry keys
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:1300

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1300-134-0x000002882D4B0000-0x000002882D603000-memory.dmp

      Filesize

      1.3MB

      Download