Analysis
-
max time kernel
1823s -
max time network
1838s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-11-2022 21:43
Static task
static1
General
-
Target
Scan_Document9698-(Nov8).iso
-
Size
1.0MB
-
MD5
2c0525c54018babb42a4c123bb8a9944
-
SHA1
3ba334b1ddcbc1375477bf382db3b82e87b3a425
-
SHA256
4797a2010eb6788cf55cd1f8a70e732770e136cc34aafcd973d536c98f52f649
-
SHA512
a4409e154cf56691ec89ac92ab4f111f1c2aa0d1c209be72b7e27cf5570546012e66621c77884b5d0b712ab799846d26f6f8707e62321cec4020a655de0475a8
-
SSDEEP
24576:2L6kLUpp+h2wCb2T/C6gndKfFG7GcIvUXVETg:2LlLCKPbkn23
Malware Config
Extracted
Family
bumblebee
Botnet
0811r
C2
176.223.165.108:443
146.19.253.28:443
146.70.149.38:443
rc4.plain
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 66 532 rundll32.exe 77 532 rundll32.exe 83 532 rundll32.exe 86 532 rundll32.exe 92 532 rundll32.exe 94 532 rundll32.exe 102 532 rundll32.exe 117 532 rundll32.exe 121 532 rundll32.exe 124 532 rundll32.exe 126 532 rundll32.exe 138 532 rundll32.exe 139 532 rundll32.exe 141 532 rundll32.exe 142 532 rundll32.exe 143 532 rundll32.exe 144 532 rundll32.exe 146 532 rundll32.exe 147 532 rundll32.exe 149 532 rundll32.exe 150 532 rundll32.exe 152 532 rundll32.exe 153 532 rundll32.exe 155 532 rundll32.exe 156 532 rundll32.exe 157 532 rundll32.exe 159 532 rundll32.exe 160 532 rundll32.exe 162 532 rundll32.exe 163 532 rundll32.exe 164 532 rundll32.exe 165 532 rundll32.exe 167 532 rundll32.exe 168 532 rundll32.exe 170 532 rundll32.exe 171 532 rundll32.exe 173 532 rundll32.exe 174 532 rundll32.exe 176 532 rundll32.exe 178 532 rundll32.exe 179 532 rundll32.exe 181 532 rundll32.exe 182 532 rundll32.exe 183 532 rundll32.exe 184 532 rundll32.exe 186 532 rundll32.exe 187 532 rundll32.exe 188 532 rundll32.exe 189 532 rundll32.exe 190 532 rundll32.exe 192 532 rundll32.exe 193 532 rundll32.exe 195 532 rundll32.exe 196 532 rundll32.exe 197 532 rundll32.exe 199 532 rundll32.exe 200 532 rundll32.exe 202 532 rundll32.exe 203 532 rundll32.exe 204 532 rundll32.exe 206 532 rundll32.exe 207 532 rundll32.exe 209 532 rundll32.exe 210 532 rundll32.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\E: cmd.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 532 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2668 wrote to memory of 3300 2668 cmd.exe 93 PID 2668 wrote to memory of 3300 2668 cmd.exe 93 PID 3300 wrote to memory of 1880 3300 cmd.exe 94 PID 3300 wrote to memory of 1880 3300 cmd.exe 94 PID 3300 wrote to memory of 532 3300 cmd.exe 95 PID 3300 wrote to memory of 532 3300 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Scan_Document9698-(Nov8).iso1⤵PID:2724
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4876
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "E:\oxen\fixture.cmd"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K oxen\ufo.cmd system rundl2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\system32\replace.exereplace C:\Windows\\system32\\rundll32.exe C:\Users\Admin\AppData\Local\Temp /A3⤵PID:1880
-
-
C:\Windows\system32\rundll32.exerundll32.exe oxen\dusty.jpg,PUpdate3⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:532
-
-