Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/02/2024, 17:01

General

  • Target

    8ae7694001a73e0eebf0ea394396cd1aacc3a817e1e321da288e445f4feb1465.msi

  • Size

    7.8MB

  • MD5

    cbce77f88d5fd1df590d5172bbb83a2c

  • SHA1

    65bd87e1c512e9cd60a3952e0712d0f67aa952e1

  • SHA256

    8ae7694001a73e0eebf0ea394396cd1aacc3a817e1e321da288e445f4feb1465

  • SHA512

    4d579a70782b99c4fb19398f9d7b430cbe5f9ee5b67dbf360f543fecd010aba373a43266b63b5e7bbe00f8636cdd7d9346806cdaffbaa02608c08310cd752ded

  • SSDEEP

    196608:jxaEo5JeKKpyRqNJMWb75RGlzGban/ba:joEWJeKKpyRqNJMWb75RGlzGbCba

Malware Config

Extracted

Family

bumblebee

Botnet

onkomsi2

Attributes
  • dga

    n64c2akw.life

    zefawfb0.life

    dph3pby8.life

    hx0hysyg.life

    1qa3k743.life

    luw8ubf2.life

    rbvsf6io.life

    4huoqrsp.life

    8qwcvseh.life

    37zi55wc.life

    i9f44mju.life

    aqnx9c9h.life

    3nmeg5wa.life

    r5ue5rok.life

    et53yjoc.life

    tvgco82h.life

    0xtmu3tz.life

    6xhpschv.life

    6o26tws0.life

    0oz7923s.life

    54y2q50j.life

    9hh7hq5r.life

    r0ca080m.life

    43vtghfz.life

    qal55els.life

    p5e68m36.life

    x698iah6.life

    kqn0zkig.life

    wq6w8jkq.life

    i6n08gx7.life

  • dga_seed

    anjd78ka

  • domain_length

    8

  • num_dga_domains

    100

  • port

    443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a loader malware written in C++.

  • Blocklisted process makes network request 4 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Loads dropped DLL 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\8ae7694001a73e0eebf0ea394396cd1aacc3a817e1e321da288e445f4feb1465.msi
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:636
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 465F3CE80F688C03FEA5DC0BD78DCB95
      2⤵
      • Loads dropped DLL
      PID:2856
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding DFF81969323DD8AEACA89905F0E8FE72
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Loads dropped DLL
      PID:4788
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:368

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Installer\MSI1099.tmp

      Filesize

      2.1MB

      MD5

      bedb0f369ebb79dbcf856379ecb6566c

      SHA1

      4a8c27c1a2f0be31b73fdad222782648c9ce6b0c

      SHA256

      189046093d0018570c1d9a12ad4aca14d4ccd65fb63d228275fd7067c24d2ecd

      SHA512

      06a3d60bf011453711d2f1df385b28edc3815f6e108567169690821b3085b8fda526a123cfbacb6e42290a0576fa878c41cdebef77609367965df12a159a02ee

    • C:\Windows\Installer\MSI51C.tmp

      Filesize

      721KB

      MD5

      5a1f2196056c0a06b79a77ae981c7761

      SHA1

      a880ae54395658f129e24732800e207ecd0b5603

      SHA256

      52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e

      SHA512

      9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a

    • memory/4788-29-0x000002AC92A90000-0x000002AC92CA8000-memory.dmp

      Filesize

      2.1MB

    • memory/4788-25-0x00007FFA25AF0000-0x00007FFA25CE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4788-26-0x000002AC92A90000-0x000002AC92CA8000-memory.dmp

      Filesize

      2.1MB

    • memory/4788-28-0x00007FFA25AF0000-0x00007FFA25CE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4788-24-0x000002AC92780000-0x000002AC92867000-memory.dmp

      Filesize

      924KB

    • memory/4788-27-0x000002AC92A90000-0x000002AC92CA8000-memory.dmp

      Filesize

      2.1MB

    • memory/4788-30-0x00007FFA25AF0000-0x00007FFA25CE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4788-31-0x00007FFA25AF0000-0x00007FFA25CE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4788-32-0x000002AC92A90000-0x000002AC92CA8000-memory.dmp

      Filesize

      2.1MB

    • memory/4788-33-0x00007FFA25AF0000-0x00007FFA25CE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4788-34-0x000002AC92780000-0x000002AC92867000-memory.dmp

      Filesize

      924KB

    • memory/4788-35-0x00007FFA25AF0000-0x00007FFA25CE5000-memory.dmp

      Filesize

      2.0MB