Analysis
-
max time kernel
295s -
max time network
360s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
09-11-2022 11:39
Static task
static1
Behavioral task
behavioral1
Sample
b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
General
-
Target
b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e
-
Size
5.1MB
-
MD5
3b95df58613ef642a6a2f057b9b4c73c
-
SHA1
0005be24d1c69eec92305e7eec1ad3c594227e73
-
SHA256
b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e
-
SHA512
e1b49faf9d254ea335aeede2befe907f02e235c38912cc0deb0be7e26605f9e9581974c33110c0a51f274ba33c055ffdd42a13771bc3d48b164d82bf55667063
-
SSDEEP
49152:/it3gMpeqVgFxvIzsAWMesEaeTHTd0vdL0ELrx2A0oK4818p5GtNcSgiGUHk5PkD:/YPeqVDBWMPEaUedtLbykh
Malware Config
Extracted
Family
bumblebee
Botnet
0605r
C2
64.44.141.177:443
104.168.218.225:443
68.233.238.126:443
206.54.190.170:443
23.83.133.13:443
rc4.plain
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 15 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 9 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Identifies Wine through registry keys 2 TTPs 3 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Wine rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Wine rundll32.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Wine rundll32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe 316 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 2872 7zG.exe Token: 35 2872 7zG.exe Token: SeSecurityPrivilege 2872 7zG.exe Token: SeSecurityPrivilege 2872 7zG.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2872 7zG.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4416 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e1⤵PID:2532
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2668
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\b2c28cdc4468f65e6fe2f5ef3691fa682057ed51c4347ad6b9672a9e19b5565e~\" -spe -an -ai#7zMap325:200:7zEvent79031⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2872
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" kiol5.dll,MDbJvVaNCR1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:316
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4416
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" kiol5.dll,MDbJvVaNCR1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
PID:4856
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" kiol5.dll,MDbJvVaNCR1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
PID:4364