Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
07-02-2025 00:42
General
-
Target
6233c74d44b7206f00d9c86ccac29577e3ea5f4b8a4a8cf8faf64d159d0e10bd.dll
-
Size
2.7MB
-
MD5
4d9d368872e1d819968c6aba4938fd61
-
SHA1
dc22a03c0bca99fef3a8e9e801fe9e43cda240be
-
SHA256
6233c74d44b7206f00d9c86ccac29577e3ea5f4b8a4a8cf8faf64d159d0e10bd
-
SHA512
ba176147280cfa54670c49befcc7f49ce50a4a41214718e647a1fe19ae4b61fce1fecd7785bb284a20f14523ff8d91a03e72a36f0e4703b5c284cc3f85070129
-
SSDEEP
49152:ydhvtC1w3DBJXHUlz6b13GtTfOL7vPsBjLAgbIYETghETcltJf:ydysBVHWz6b13GtTfOL7vPsBjLAgbIYl
Malware Config
Extracted
bumblebee
ALL0604
192.236.198.63:443
Signatures
-
BumbleBee
BumbleBee is a loader malware written in C++.
-
Bumblebee family
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Blocklisted process makes network request 6 IoCs
-
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6233c74d44b7206f00d9c86ccac29577e3ea5f4b8a4a8cf8faf64d159d0e10bd.dll,#11⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Blocklisted process makes network request
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB