Analysis
-
max time kernel
91s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2022 15:52
Static task
static1
Behavioral task
behavioral1
Sample
2510c_cr91.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
2510c_cr91.exe
-
Size
2.7MB
-
MD5
20bd75258104890098ee94b466723f93
-
SHA1
b4e70128b9aef480732f2bd0926e5274e460cb54
-
SHA256
f9e77626767296ac5e6fc6510d74d6417c290146e216c194643b586b0437ab3f
-
SHA512
964126f4ccb2410a98c5c1026aeac3f795906942112585a5c8f36970db5c9034132913794bc3ef846c08c6884ac9b171ec58689b43f8005d36c2f72f59edb1f8
-
SSDEEP
49152:N35sE1ooe/bEhL9ni0V39wArTXkngnUQGB5BAc0B4VwS:Np1ooKQpfKOkAGNAVhS
Malware Config
Extracted
Family
bumblebee
Botnet
2510
C2
69.46.15.158:443
135.125.241.35:443
172.86.120.141:443
rc4.plain
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest 2510c_cr91.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse 2510c_cr91.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService 2510c_cr91.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 2510c_cr91.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo 2510c_cr91.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ 2510c_cr91.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ 2510c_cr91.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2510c_cr91.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 2510c_cr91.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2510c_cr91.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2510c_cr91.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2510c_cr91.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Wine 2510c_cr91.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 5064 2510c_cr91.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe 5064 2510c_cr91.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2510c_cr91.exe"C:\Users\Admin\AppData\Local\Temp\2510c_cr91.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5064