Analysis
-
max time kernel
127s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 09:53
Static task
static1
Behavioral task
behavioral1
Sample
2510c_cr29.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
2510c_cr29.exe
-
Size
2.7MB
-
MD5
7e869bf508f17734a0d41373f4d84bc2
-
SHA1
34886f40b8d6dc97c8892ce2fc2afc367d283439
-
SHA256
e78686c842f5497fa096978d9c4e7b4bff76cb4f34bba2a9d4fb64d06e554a2f
-
SHA512
36cd829cc13919c23fcc6f0d361ca443d65c003b3d77cbe0771d81415bc6660f1a69b18fe4beb3d79754051528d157b7b0ecc209918382514ec9cfd454d50dae
-
SSDEEP
49152:/lP4yUfaW/LjawSoLABLbudAHfMOU++kH/:9WfamLXCbuikOU+d/
Malware Config
Extracted
Family
bumblebee
Botnet
2510
C2
69.46.15.158:443
135.125.241.35:443
172.86.120.141:443
rc4.plain
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF 2510c_cr29.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo 2510c_cr29.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest 2510c_cr29.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse 2510c_cr29.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService 2510c_cr29.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2510c_cr29.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ 2510c_cr29.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ 2510c_cr29.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 2510c_cr29.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2510c_cr29.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2510c_cr29.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 2510c_cr29.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Wine 2510c_cr29.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 5000 2510c_cr29.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe 5000 2510c_cr29.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2510c_cr29.exe"C:\Users\Admin\AppData\Local\Temp\2510c_cr29.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5000