Resubmissions

09-10-2023 22:51

231009-2sxxvaha2s 10

20-06-2023 19:13

230620-xxhlhafa7y 10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2023 19:13

General

  • Target

    doc_06.20.msi

  • Size

    2.2MB

  • MD5

    41f1f58087ac8ca8009d07032bf4319f

  • SHA1

    8ab6be5ac1e70f9cf1a970e4a7b2c53f29dac067

  • SHA256

    38c37a12323334e8362d19f6788755fc5ba35f51b9f53a07ef5481f906807864

  • SHA512

    0c60361265f062afeab7f03e648da982050fa58b86bdf90d972b2a936a5c316cb45c6d696a106f18797e2d9810ace6ca12a13703be4cbaf618c50f3e4d4ba359

  • SSDEEP

    49152:QHVNAxnHKwlpMBHOZ7wZAf8dwjeZvpA+ZSqfShYNUeCMziwF:Q12xHKwlpOH00dw0pFsbJZA

Malware Config

Extracted

Family

bumblebee

Botnet

msi11606

C2

176.111.174.67:443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\doc_06.20.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1972
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:960
      • C:\Windows\system32\regsvr32.exe
        regsvr32 "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\e1.dll"
        2⤵
        • Loads dropped DLL
        • Suspicious use of NtCreateThreadExHideFromDebugger
        PID:4152
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4192

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e56ec5a.rbs

      Filesize

      7KB

      MD5

      3842e5d711099fa7ae9772ec1e0f75cd

      SHA1

      c4a7945bab405b2d9b533c8f2c94a2a7e83fb9a1

      SHA256

      bab6dfdd548fd8d101ec78042a003fb9203e12a1ad83c36caa22b58ed1aebc0a

      SHA512

      2c5e60e0355d919aecc4281ed608a53fcb3c59a543f6f680b7a94a0efbd6bb00c7e8d9076b90275a30b1bdee16b4aedeaa26d27b2955a6ca27317fb50db2bc56

    • C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\e1.dll

      Filesize

      2.5MB

      MD5

      04889da884690bd296877a6a2453a715

      SHA1

      235a8e9a16a4e963fb2c453cbb469ea3e1590da3

      SHA256

      d1270e29d9a235bb456db76f5c88042eb06964145dd2b31f2ef87d5af1254e57

      SHA512

      74875267c6b96ef6c44ac19021f96213cd115061f881b22d849ebc98aa21c92af64f46c86b908b2da53d3f6fe8d9e7bd291ce11882cff0d11bf1294a39c58cc2

    • C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\e1.dll

      Filesize

      2.5MB

      MD5

      04889da884690bd296877a6a2453a715

      SHA1

      235a8e9a16a4e963fb2c453cbb469ea3e1590da3

      SHA256

      d1270e29d9a235bb456db76f5c88042eb06964145dd2b31f2ef87d5af1254e57

      SHA512

      74875267c6b96ef6c44ac19021f96213cd115061f881b22d849ebc98aa21c92af64f46c86b908b2da53d3f6fe8d9e7bd291ce11882cff0d11bf1294a39c58cc2

    • C:\Windows\Installer\e56ec59.msi

      Filesize

      2.2MB

      MD5

      41f1f58087ac8ca8009d07032bf4319f

      SHA1

      8ab6be5ac1e70f9cf1a970e4a7b2c53f29dac067

      SHA256

      38c37a12323334e8362d19f6788755fc5ba35f51b9f53a07ef5481f906807864

      SHA512

      0c60361265f062afeab7f03e648da982050fa58b86bdf90d972b2a936a5c316cb45c6d696a106f18797e2d9810ace6ca12a13703be4cbaf618c50f3e4d4ba359

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

      Filesize

      23.0MB

      MD5

      0ded11f295fe29549a5bfc058f30ee03

      SHA1

      637bbad072ccbaa6e5eec0afcaded3d5c1b3a8fe

      SHA256

      6848b312e6477de456d95db7c76a2d86ac658a26fc279f5d9eb64bc613548ebe

      SHA512

      e876497443d0e071bf29bcd5089da9183edd53d3950345072ce907bdf49d716f9d8c49f6664b4e059e6cfd1914043df6005d7ff7edafa6782403a2f484061305

    • \??\Volume{c9ab6598-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{4e20789d-358f-4135-91e5-e1e094a72117}_OnDiskSnapshotProp

      Filesize

      5KB

      MD5

      c65a80683f731e780634ab2c1d3cb710

      SHA1

      34733af461238a9c2e1d9043a9b0dc6cb3fa9f76

      SHA256

      fe1afe45074c9724774e0925d0e6757faba8eea854ffe78da35903b9eb679b5f

      SHA512

      82a2ae015e35c2b6797001a783de557813bbdd63b9e1d791274b4b8e4758cfe7dd597abf87cab212d003d8bfdc7d295d930ca80256a68f270df8669dc0c220a2

    • memory/4152-157-0x0000000002670000-0x00000000027D1000-memory.dmp

      Filesize

      1.4MB

    • memory/4152-158-0x0000000002670000-0x00000000027D1000-memory.dmp

      Filesize

      1.4MB

    • memory/4152-159-0x0000000002670000-0x00000000027D1000-memory.dmp

      Filesize

      1.4MB

    • memory/4152-160-0x0000000002670000-0x00000000027D1000-memory.dmp

      Filesize

      1.4MB

    • memory/4152-161-0x0000000002500000-0x0000000002666000-memory.dmp

      Filesize

      1.4MB

    • memory/4152-162-0x0000000002670000-0x00000000027D1000-memory.dmp

      Filesize

      1.4MB