Analysis
-
max time kernel
139s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
14/03/2025, 07:45
General
-
Target
abaf649e6440033ea250691e6bff02c8924a5f9b827168f576606835d7a820a0.dll
-
Size
2.1MB
-
MD5
5758813f20b1b3f041b20f700e61ca2c
-
SHA1
5cf76172c4b3c33f2f64536ebdf7d6a5935350d0
-
SHA256
abaf649e6440033ea250691e6bff02c8924a5f9b827168f576606835d7a820a0
-
SHA512
69b1955969eb7f7712698360ce85baad22fa90c3ca3b58fdaeb1637f7119639aecb9eb215e35c55aa0a2c375601a54633fc3b26badcc24b350251307130870d9
-
SSDEEP
49152:tbhl087l5fJeS/DrSoUtP9qqyD8e3+DSP9yJoZS:tLTfJtylPyD8e5MJoZS
Malware Config
Extracted
bumblebee
RA1104
142.91.3.109:443
23.83.133.216:443
Signatures
-
BumbleBee
BumbleBee is a loader malware written in C++.
-
Bumblebee family
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Blocklisted process makes network request 5 IoCs
-
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\abaf649e6440033ea250691e6bff02c8924a5f9b827168f576606835d7a820a0.dll,#11⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Blocklisted process makes network request
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB