Analysis
-
max time kernel
37s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
07-11-2022 09:53
General
-
Target
2510c_cr29.exe
-
Size
2.7MB
-
MD5
7e869bf508f17734a0d41373f4d84bc2
-
SHA1
34886f40b8d6dc97c8892ce2fc2afc367d283439
-
SHA256
e78686c842f5497fa096978d9c4e7b4bff76cb4f34bba2a9d4fb64d06e554a2f
-
SHA512
36cd829cc13919c23fcc6f0d361ca443d65c003b3d77cbe0771d81415bc6660f1a69b18fe4beb3d79754051528d157b7b0ecc209918382514ec9cfd454d50dae
-
SSDEEP
49152:/lP4yUfaW/LjawSoLABLbudAHfMOU++kH/:9WfamLXCbuikOU+d/
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
2510
C2
69.46.15.158:443
135.125.241.35:443
172.86.120.141:443
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2510c_cr29.exe"C:\Users\Admin\AppData\Local\Temp\2510c_cr29.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
1.3MB