Resubmissions
13-10-2022 05:26
221013-f44zmsagfm 1013-10-2022 05:21
221013-f2ft2abae7 105-07-2022 20:58
220705-zsep6achfq 10Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2022 05:26
Static task
static1
Behavioral task
behavioral1
Sample
Project requirements.lnk
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Project requirements.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
prjct.dll
Resource
win7-20220901-en
windows7-x64
12 signatures
150 seconds
General
-
Target
Project requirements.lnk
-
Size
1KB
-
MD5
6ca6a8b1a8d781bc91444dc2402d3f58
-
SHA1
a66015ece818c3c35d0ae8a400ee9c102425186b
-
SHA256
3926bec362d86edc8fcc4e283d6b93b21108d6b9d194de9fc1108df2944b0319
-
SHA512
f778da9c3762ceb37b65c6ba6864e6158e44a99eb776108825c02b4bb56dc309ec4998eb66b053cff99984294f49365b6a50bf8e83e07ec58782a80fbdf5b2a9
Malware Config
Extracted
Family
bumblebee
Botnet
407a
C2
103.175.16.49:443
209.141.41.46:443
45.153.242.183:443
rc4.plain
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse odbcconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService odbcconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF odbcconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo odbcconf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest odbcconf.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ odbcconf.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ odbcconf.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ odbcconf.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions odbcconf.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion odbcconf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion odbcconf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate odbcconf.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation cmd.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Wine odbcconf.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1060 odbcconf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe 1060 odbcconf.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3940 wrote to memory of 1060 3940 cmd.exe 82 PID 3940 wrote to memory of 1060 3940 cmd.exe 82
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Project requirements.lnk"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\System32\odbcconf.exe"C:\Windows\System32\odbcconf.exe" -f prjct.rsp2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1060
-