Analysis
-
max time kernel
134s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2023 19:00
Static task
static1
Behavioral task
behavioral1
Sample
ambien.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ambien.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
cookies.bat
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
cookies.bat
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
project information.lnk
Resource
win7-20220812-en
General
-
Target
project information.lnk
-
Size
981B
-
MD5
ab75f98820d239a2f300d1258e65ff57
-
SHA1
9571afbbc444cdf6ede14c0996e6e915ef21baed
-
SHA256
0d395daea134bf3ad5d52e47424725842391ceef3fba206031038f9d9f570191
-
SHA512
9929dc69ce18949b9b6efb36d501bb92a7ae7f18a82f61245088de474258ab8c33e701bc4e5f52394a7bbe80bec48269989ada0ed989ef206e3040b27a45a6ea
Malware Config
Extracted
bumblebee
102lg
146.70.29.237:443
205.185.113.34:443
23.106.223.182:443
103.144.139.146:443
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1752 u9OwF0LTWHo.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1752 u9OwF0LTWHo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5056 wrote to memory of 648 5056 cmd.exe 82 PID 5056 wrote to memory of 648 5056 cmd.exe 82 PID 648 wrote to memory of 364 648 cmd.exe 83 PID 648 wrote to memory of 364 648 cmd.exe 83 PID 364 wrote to memory of 1036 364 cmd.exe 84 PID 364 wrote to memory of 1036 364 cmd.exe 84 PID 648 wrote to memory of 1752 648 cmd.exe 85 PID 648 wrote to memory of 1752 648 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\project information.lnk"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c cookies.bat2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\system32\cmd.execmd.exe /c start /b /min copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\u9OwF0LTWHo.exe3⤵
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K copy /Y C:\Windows\System32\rundll32.exe C:\ProgramData\u9OwF0LTWHo.exe4⤵PID:1036
-
-
-
C:\ProgramData\u9OwF0LTWHo.exe"C:\ProgramData\u9OwF0LTWHo.exe" ambien.dll,stProgNew3⤵
- Executes dropped EXE
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:1752
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD5ef3179d498793bf4234f708d3be28633
SHA1dd399ae46303343f9f0da189aee11c67bd868222
SHA256b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
SHA51202aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e
-
Filesize
70KB
MD5ef3179d498793bf4234f708d3be28633
SHA1dd399ae46303343f9f0da189aee11c67bd868222
SHA256b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa
SHA51202aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e