Analysis
-
max time kernel
148s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-10-2024 01:40
General
-
Target
7df703625ee06db2786650b48ffefb13fa1f0dae41e521b861a16772e800c115.dll
-
Size
2.1MB
-
MD5
40ee908eff9418d1cbcb36ea516ca34e
-
SHA1
e13e947f3ce59a2a58ce09c2d8888053d685fa44
-
SHA256
7df703625ee06db2786650b48ffefb13fa1f0dae41e521b861a16772e800c115
-
SHA512
eedae343bf53411aa9a64e0f6ae9ee1ac15b6cdc02d94894604974e5d0ffcafc56f9df9afa368cab38a017785e559d75bb9dea95bffc78088048cf3b1ec7d639
-
SSDEEP
49152:AgbA0SNOgGbH+/mrzAnO5oEshZHFTdgmH:v20gGjnrzAZEIZHzgmH
Malware Config
Extracted
bumblebee
msi
-
dga
tvx1ovdepj8.life
acgr6r8zdot.life
ilofx941igp.life
8x2apo5m7ri.life
x9yrzer0ndt.life
93j4v4jopzd.life
ameagxzo2f7.life
nyy41uibsv5.life
ru4jvijdytq.life
l9t6r0y6cvi.life
f4vb9n3tdvh.life
9do3mcejztt.life
pxu1ajsdhqr.life
7exy2b231n2.life
vu5b47m18jn.life
6mnudp7zj73.life
p5047yjrb8q.life
d0xtxp89bb9.life
ygo9u1fkwux.life
fig3gj0v6qe.life
38f5wvwwn7o.life
txgogs9p8a1.life
uyn0icgx1kv.life
2z1ls31az7s.life
0cc2z8zrnhf.life
fsr2hskx44p.life
du19ek78tjw.life
234ct3lkozp.life
he8fq4k8d3w.life
7ewh8ltr7il.life
-
dga_seed
1.0163655285949564e+18
-
domain_length
11
-
num_dga_domains
100
-
port
443
Signatures
-
BumbleBee
BumbleBee is a loader malware written in C++.
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\7df703625ee06db2786650b48ffefb13fa1f0dae41e521b861a16772e800c115.dll1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
992KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
1.7MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
2.1MB
-
Filesize
992KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB