Analysis
- max time kernel
170s - max time network
192s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
07/11/2022, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
2510c_cr29.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
- Target 2510c_cr29.exe
- Size 2.7MB
- Sample221107-ltxepsadd5
- SHA256 e78686c842f5497fa096978d9c4e7b4bff76cb4f34bba2a9d4fb64d06e554a2f
- MD5 7e869bf508f17734a0d41373f4d84bc2
- SHA1 34886f40b8d6dc97c8892ce2fc2afc367d283439
- SHA512 36cd829cc13919c23fcc6f0d361ca443d65c003b3d77cbe0771d81415bc6660f1a69b18fe4beb3d79754051528d157b7b0ecc209918382514ec9cfd454d50dae
- SSDEEP 49152:/lP4yUfaW/LjawSoLABLbudAHfMOU++kH/:9WfamLXCbuikOU+d/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
2510
C2
-
69.46.15.158:443
-
135.125.241.35:443
-
172.86.120.141:443
rc4.plain
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService 2510c_cr29.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 2510c_cr29.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo 2510c_cr29.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest 2510c_cr29.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse 2510c_cr29.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ 2510c_cr29.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ 2510c_cr29.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2510c_cr29.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 2510c_cr29.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2510c_cr29.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2510c_cr29.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2510c_cr29.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Wine 2510c_cr29.exe - Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2200 2510c_cr29.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe 2200 2510c_cr29.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2510c_cr29.exe"C:\Users\Admin\AppData\Local\Temp\2510c_cr29.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2200