Analysis
-
max time kernel
39s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
13-10-2022 00:51
Static task
static1
Behavioral task
behavioral1
Sample
dd204ab6-b2ca-4f8c-8f6b-b70093a2ec80.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
dd204ab6-b2ca-4f8c-8f6b-b70093a2ec80.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
file-ea1bb905-6718-4e55-8cb2-4f2cfbf2cd23.lnk
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
file-ea1bb905-6718-4e55-8cb2-4f2cfbf2cd23.lnk
Resource
win10v2004-20220812-en
General
-
Target
file-ea1bb905-6718-4e55-8cb2-4f2cfbf2cd23.lnk
-
Size
1KB
-
MD5
25804c14d838ee802da26c6c394059ff
-
SHA1
8f9f2311b1962bbf2d433a419b5b6dd8c0788366
-
SHA256
63f8f0291ea92dbb363dec39ec1b6ccfce854ea4f7abdb9b8a2907594d7dca32
-
SHA512
484151f2d04ae782fe8fcacc09f33e31ae56dfaaa87e1d23e751651abb6ad4cf9f6d0f0f1377d30096ae822bd3222f8f196bd876871048f813409d76fcfea0ee
Malware Config
Extracted
bumblebee
1010
51.83.250.153:443
194.135.33.40:443
185.145.97.141:443
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
rundll32.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Wine rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
rundll32.exepid process 1176 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
rundll32.exepid process 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe 1176 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.execmd.exedescription pid process target process PID 1148 wrote to memory of 268 1148 cmd.exe cmd.exe PID 1148 wrote to memory of 268 1148 cmd.exe cmd.exe PID 1148 wrote to memory of 268 1148 cmd.exe cmd.exe PID 268 wrote to memory of 1176 268 cmd.exe rundll32.exe PID 268 wrote to memory of 1176 268 cmd.exe rundll32.exe PID 268 wrote to memory of 1176 268 cmd.exe rundll32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\file-ea1bb905-6718-4e55-8cb2-4f2cfbf2cd23.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start 93059f5c-b5de-43c5-9547-6c9c4b53455a.png && start ru^n^d^l^l3^2 dd204ab6-b2ca-4f8c-8f6b-b70093a2ec80.Vpy,minload2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32 dd204ab6-b2ca-4f8c-8f6b-b70093a2ec80.Vpy,minload3⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-89-0x0000000000000000-mapping.dmp
-
memory/268-143-0x0000000000380000-0x0000000000390000-memory.dmpFilesize
64KB
-
memory/1148-54-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmpFilesize
8KB
-
memory/1176-144-0x0000000000000000-mapping.dmp
-
memory/1176-145-0x0000000001D80000-0x0000000001ED3000-memory.dmpFilesize
1.3MB