Analysis
- max time kernel
140s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
07/11/2022, 09:52
Static task
static1
Behavioral task
behavioral1
Sample
2510c_cr69.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
- Target 2510c_cr69.exe
- Size 2.7MB
- Sample221107-lv22ksaea2
- SHA256 aea6933430252325e7bec04d778064ff973a4db0d7dd237622efca5ad1f7db20
- MD5 bf5889c772dd1377789fb54da0c6d08c
- SHA1 ffb4b43e63cdc19f6bd7904a8bccd16038780b23
- SHA512 e34e4019694390c69084b05cea1707f730808a09521284ac7fe082e48eff9a0401fdb884f770dee3053a24247baca4a2c409f4be2d80da06dec9269d68053caa
- SSDEEP 49152:ltOeGMX6zeiTFzMg1I24bcsgWeJnuNQXh:lrGk6CidgzLeJnuNQX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
2510
C2
-
69.46.15.158:443
-
135.125.241.35:443
-
172.86.120.141:443
rc4.plain
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest 2510c_cr69.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse 2510c_cr69.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService 2510c_cr69.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 2510c_cr69.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo 2510c_cr69.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2510c_cr69.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ 2510c_cr69.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ 2510c_cr69.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 2510c_cr69.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2510c_cr69.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2510c_cr69.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2510c_cr69.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Wine 2510c_cr69.exe - Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4640 2510c_cr69.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe 4640 2510c_cr69.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2510c_cr69.exe"C:\Users\Admin\AppData\Local\Temp\2510c_cr69.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4640