Resubmissions
13-10-2022 05:26
221013-f44zmsagfm 1013-10-2022 05:21
221013-f2ft2abae7 105-07-2022 20:58
220705-zsep6achfq 10Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
13-10-2022 05:26
Static task
static1
Behavioral task
behavioral1
Sample
Project requirements.lnk
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Project requirements.lnk
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
prjct.dll
Resource
win7-20220901-en
windows7-x64
12 signatures
150 seconds
General
-
Target
prjct.dll
-
Size
1.5MB
-
MD5
dd9751f48c134f502d5a7a5b39b482be
-
SHA1
d7ecfa85e28318bd0179d321be7d32c468fc9dae
-
SHA256
cbef35e0d91b5f169a3bd617c9ebcb3ea025439cb98e3d4a7dbeed4be65b6ef2
-
SHA512
381889e149f2b49a50f312c47e1e42cefd7bb5eb79013b2ff3213b5161160015f7f75d6b3d4d4f9b07a303599e904433a271fdcada8255e7deb229e8ad6dc6b9
-
SSDEEP
24576:0nA0ZF8YNPCW9dlicjpZVCkgJ0jlSN/wUx1DmFbxsxhz4tW7:0nA0oKPCWocjpZVz00jhUx1D5z3
Malware Config
Extracted
Family
bumblebee
Botnet
407a
C2
103.175.16.49:443
209.141.41.46:443
45.153.242.183:443
rc4.plain
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo regsvr32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ regsvr32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ regsvr32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions regsvr32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion regsvr32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate regsvr32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Wine regsvr32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1184 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1184 regsvr32.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1744 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1744 taskmgr.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe -
Suspicious use of SendNotifyMessage 41 IoCs
pid Process 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe 1744 taskmgr.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\prjct.dll1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1744