Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
22-11-2023 17:28
General
-
Target
af5af36999fcc71cf7e93bbe64bb6299509dde3e40c5b78978ee3cd5b5ddda7d.dll
-
Size
2.1MB
-
MD5
bda498a62a5b68b5c8221807723d97cb
-
SHA1
f5383697baf1a1433fe5dc948c842c55af84f949
-
SHA256
af5af36999fcc71cf7e93bbe64bb6299509dde3e40c5b78978ee3cd5b5ddda7d
-
SHA512
bb8e300ba275bc982252fb60503ac453a663f2f1b4a4803dace2226fc2b19cb43fa630fec1a7c7b67667bce014f9534ab855a3d1cb112c37dcd080ce40c01823
-
SSDEEP
24576:BsuWJHq2ZaUp3ZWSH1YuAB8EqU+7nm1CJDKL75F1ZuPZfSpNRuXDsY22G9KPzmkX:KpHqxAZRrA8XSIb7GtY
Malware Config
Extracted
bumblebee
f1
-
dga
n64c2akw.life
zefawfb0.life
dph3pby8.life
hx0hysyg.life
1qa3k743.life
luw8ubf2.life
rbvsf6io.life
4huoqrsp.life
8qwcvseh.life
37zi55wc.life
i9f44mju.life
aqnx9c9h.life
3nmeg5wa.life
r5ue5rok.life
et53yjoc.life
tvgco82h.life
0xtmu3tz.life
6xhpschv.life
6o26tws0.life
0oz7923s.life
54y2q50j.life
9hh7hq5r.life
r0ca080m.life
43vtghfz.life
qal55els.life
p5e68m36.life
x698iah6.life
kqn0zkig.life
wq6w8jkq.life
i6n08gx7.life
-
dga_seed
anjd78ka
-
domain_length
8
-
num_dga_domains
100
-
port
443
Signatures
-
BumbleBee
BumbleBee is a loader malware written in C++.
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\af5af36999fcc71cf7e93bbe64bb6299509dde3e40c5b78978ee3cd5b5ddda7d.dll1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtCreateThreadExHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
924KB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
924KB
-
Filesize
2.0MB