Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2023, 18:55

General

  • Target

    samsung.bat

  • Size

    1KB

  • MD5

    d9c85f2b71f3845c6eccfc9cf0d61f5f

  • SHA1

    87e33805b660677abf211a026d6571929007cd45

  • SHA256

    a897ba334569f2bf0fcf2741cd644d5975221f009228243b140013a6bd6a2776

  • SHA512

    1ed3bebdfc33c68253d63a3290fb76c681f928c902c476e749a00cbece97aa66d8b615fce8c0ef5905c13ea71aa5049c70c076680f89e5d93e53437e69f17fd6

Score
10/10

Malware Config

Extracted

Family

bumblebee

Botnet

102lg

C2

146.70.29.237:443

205.185.113.34:443

23.106.223.182:443

103.144.139.146:443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\samsung.bat"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Windows\system32\cmd.exe
      cmd.exe /c start /b /min copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\G84IrBV5PP.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2920
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /K copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\G84IrBV5PP.exe
        3⤵
          PID:4448
      • C:\ProgramData\G84IrBV5PP.exe
        "C:\ProgramData\G84IrBV5PP.exe" Photos.dll,stProgNew
        2⤵
        • Executes dropped EXE
        • Suspicious use of NtCreateThreadExHideFromDebugger
        PID:3068

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\G84IrBV5PP.exe

      Filesize

      70KB

      MD5

      ef3179d498793bf4234f708d3be28633

      SHA1

      dd399ae46303343f9f0da189aee11c67bd868222

      SHA256

      b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

      SHA512

      02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

    • C:\ProgramData\G84IrBV5PP.exe

      Filesize

      70KB

      MD5

      ef3179d498793bf4234f708d3be28633

      SHA1

      dd399ae46303343f9f0da189aee11c67bd868222

      SHA256

      b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

      SHA512

      02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

    • memory/3068-137-0x000001F256120000-0x000001F256281000-memory.dmp

      Filesize

      1.4MB

    • memory/3068-138-0x000001F255EC0000-0x000001F255F3F000-memory.dmp

      Filesize

      508KB