Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
submitted
15-11-2024 15:49
General
-
Target
c65c51ed60f91a92789c4b056821ef51252baa2a1679a6513ab008acf0464ccb.dll
-
Size
3.7MB
-
MD5
8e7115ea580f39c152e4d4bc4472c402
-
SHA1
4ea1f1d8a01f251fa5db350f72b04a1d11028fb0
-
SHA256
c65c51ed60f91a92789c4b056821ef51252baa2a1679a6513ab008acf0464ccb
-
SHA512
bde81a4da80dda9e06815b153caa2dcaea874bfd973c9d24b1e935e0c88a0d094dcce0b153d9866a87b2b06bc636a30b23d3fe27e345b4a2ee174b52acc44619
-
SSDEEP
98304:XZo5q0spyUTJkqVnIY0z7ceiVNhPvpx3:XZwqlp51krrz4vp
Malware Config
Extracted
bumblebee
2104a
282.19.133.12:443
91.122.18.192:443
185.156.172.62:443
72.123.65.11:443
149.255.35.167:443
172.241.27.146:443
Signatures
-
BumbleBee
BumbleBee is a loader malware written in C++.
-
Bumblebee family
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Blocklisted process makes network request 5 IoCs
-
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c65c51ed60f91a92789c4b056821ef51252baa2a1679a6513ab008acf0464ccb.dll,#11⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Blocklisted process makes network request
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB