Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2023, 16:32

General

  • Target

    project information.lnk

  • Size

    975B

  • MD5

    662e0554d91f79fa97a53e224ac8a5bd

  • SHA1

    44b14afd5c0a849d3553e4636e0a5125abc8087d

  • SHA256

    5a32e8b0b07cc41971fc057bffa79ce0760d110d3c72e018af0c645a698cec6e

  • SHA512

    d062b646289d056cf858477b09456868a5b9f7a61788efd3f40473c64a9ff942e06f8b5581b2d295de803d3fea42ef6a86fad1a8c8e63243d8fd7380bffd0c78

Score
10/10

Malware Config

Extracted

Family

bumblebee

Botnet

132lg

C2

205.185.113.34:443

103.144.139.146:443

23.106.223.222:443

95.168.191.248:443

23.106.223.182:443

146.70.29.237:443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\project information.lnk"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c lang.bat
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Windows\system32\cmd.exe
        cmd.exe /c start /b /min copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\p4VvpBZGbyg.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4560
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /K copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\p4VvpBZGbyg.exe
          4⤵
            PID:2092
        • C:\ProgramData\p4VvpBZGbyg.exe
          "C:\ProgramData\p4VvpBZGbyg.exe" amateur.dll,Condensed
          3⤵
          • Executes dropped EXE
          • Suspicious use of NtCreateThreadExHideFromDebugger
          PID:2272

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\p4VvpBZGbyg.exe

      Filesize

      70KB

      MD5

      ef3179d498793bf4234f708d3be28633

      SHA1

      dd399ae46303343f9f0da189aee11c67bd868222

      SHA256

      b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

      SHA512

      02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

    • C:\ProgramData\p4VvpBZGbyg.exe

      Filesize

      70KB

      MD5

      ef3179d498793bf4234f708d3be28633

      SHA1

      dd399ae46303343f9f0da189aee11c67bd868222

      SHA256

      b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

      SHA512

      02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

    • memory/2272-138-0x0000013B05C10000-0x0000013B05D71000-memory.dmp

      Filesize

      1.4MB

    • memory/2272-139-0x0000013B040C0000-0x0000013B0413F000-memory.dmp

      Filesize

      508KB