Edit tour
Windows
Analysis Report
Acrobat_DC_x64_VIP_v10.12.msi
Overview
General Information
| Sample name: | Acrobat_DC_x64_VIP_v10.12.msi |
| Analysis ID: | 1560658 |
| MD5: | b9632555b2c19b9182cab9c098c22d8e |
| SHA1: | 100d612540c51413141f52c3888114cddb76e9a0 |
| SHA256: | 1164b944f47a9701ddd682f59c60425faed350647e3f9e562e1abc140a89c7f2 |
| Infos: |  |
 | |
Detection
BumbleBee
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
System process connects to network (likely due to code injection or exploit)
Yara detected BumbleBee
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Contains functionality to determine the online IP of the system
Searches for specific processes (likely to inject)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for available system drives (often done to infect USB drives)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to enumerate running services
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains functionality to query network adapater information
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Uses code obfuscation techniques (call, push, ret)
Yara signature match
Classification
- System is w10x64
msiexec.exe (PID: 7292 cmdline: "C:\Window s\System32 \msiexec.e xe" /i "C: \Users\use r\Desktop\ Acrobat_DC _x64_VIP_v 10.12.msi" MD5: E5DA170027542E25EDE42FC54C929077)
- msiexec.exe (PID: 7328 cmdline:
C:\Windows \system32\ msiexec.ex e /V MD5: E5DA170027542E25EDE42FC54C929077) 
Reader_Install_Setup.exe (PID: 7400 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\Packag e Installa tion Dir\R eader_Inst all_Setup. exe" MD5: E4E96D377207C990295577E0EBD93F79) 
rundll32.exe (PID: 7408 cmdline: "rundll32. exe" "C:\U sers\user\ AppData\Lo cal\Temp\P ackage Ins tallation Dir\qpgEZs swIP.dll", DllRegiste rServer MD5: EF3179D498793BF4234F708D3BE28633)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| BumbleBee | This malware is delivered by an ISO file, with an DLL inside with a custom loader. Because of the unique user-agent "bumblebee" this malware was dubbed BUMBLEBEE. At the time of Analysis by Google's Threat Analysis Group (TAG) BumbleBee was observed to fetch Cobalt Strike Payloads. |
{"C2 url": ["ejz7h2nwpe9p.live", "tok60x6gccij.live", "aummhmvbuvf7.live", "x5a5l51t3vh5.live", "y82gwd3wieon.live", "b8y5k2ri9mez.live", "cc3bxmp3p9ww.live", "zv119x3fg98y.live", "vrsi1nlyz8hp.live", "u8fbv3mj3v2o.live", "iri6971t7ge3.live", "9nrkgb5ymmhx.live", "72sisvsb57q6.live", "nlkef4koisho.live", "n1gd464fiz18.live", "qmgxpjkisusl.live", "vmh0ep7s9854.live", "vo3yj33yyalx.live", "541xdsl3qrmo.live", "h64g4n2r4pio.live", "bdleys30kkz3.live", "2e0ygf9sxa6j.live", "hlhhny6jyz0h.live", "w2pjbfv1lp0s.live", "ituux0ny27ur.live", "it44epclfvn0.live", "w84emvz3j8hk.live", "t6fln95iafzj.live", "jbo4jhymyavk.live", "y0rqp62hxwp0.live", "rzctrohkd26r.live", "q8txsh5ger29.live", "nmmbz5mvu9b6.live", "forned95q3gl.live", "nvzd7pgfgpxt.live", "y3md2wem8eab.live", "sztn5z9mczvv.live", "hfswfaj1th9o.live", "iaqxv2w3o0xc.live", "ugo1867z96wg.live", "sdj52uv9ye3b.live", "wrkxzshr4idg.live", "4xtvsj1w0qwx.live", "gn5827958xrg.live", "x1jlunfqrqtv.live", "hquppb63rgrg.live", "o91173l27glq.live", "3ysjrezb3os9.live", "5nhc44cf83r7.live", "utltlu232nmc.live", "px5wxjvm0958.live", "sip8h0d4tgrf.live", "3ofolpuywddt.live", "ig42hrwh0svv.live", "r4og0ibkr2i1.live", "s542jqly9hk1.live", "6yb78j9xx6kg.live", "67foms8ek35i.live", "a1xbi34msajq.live", "oltfqksrbe1h.live", "olka4w167pg5.live", "cq72kwl2pw8w.live", "em3wdkia152l.live", "4cxyghx0ba1x.live", "99onc4240lhw.live", "are8uz74o21e.live", "7u78fpro0nvy.live", "mak2p2u1p6oc.live", "3l6704byr3c4.live", "ijxbxsajcb1p.live", "qnlqvmlc95m4.live", "dkm740j7a284.live", "j40qreidx6y3.live", "we0f3yexor36.live", "dd5bzcuuvist.live", "eldzk3tkcta3.live", "a6rtdeit0sty.live", "hu3dj149h820.live", "77mk5fucuhe8.live", "437jwomut9vr.live", "eqg3217g92zf.live", "i22gcdhfevxk.live", "xxdueooznk6v.live", "tzcodnn2epik.live", "ejr4r59avayq.live", "0ws4d9s611dt.live", "frsgmv876w5a.live", "ntrzvqm429kj.live", "3l9jbihmbpmk.live", "cbugpmw95dcb.live", "miq50i5wpk85.live", "h8pwl3uhwlfn.live", "qj3zj9oywxx7.live", "zd6j8je6phb4.live", "t6ocigyxberq.live", "pdim2swkrf2v.live", "mppytmrfpgug.live", "i5ke68h24a00.live", "qxul3spnx991.live", "vzrt76g9gk0g.live", "yc6716yc7nf7.live", "87bnnasq71mu.live", "obmwpmuwhfu7.live", "0aw4a73tdsz1.live", "n6nzy4xlso4s.live", "syhmn2nbxrtr.live", "exiarctkfedq.live", "j5p6emlxlecl.live", "egdk83k09qmr.live", "0fhr0297aorb.live", "6z4lwstr3zxx.live", "lh37yjie545p.live", "lfi8tslls020.live", "ppgwgn0qtww4.live", "0k6o18rmf93s.live", "sucnfknz0x3m.live", "r33j2bx1ieh9.live", "rti8b3e5byh3.live", "uj8gs5xxvv4g.live", "y7bc5b0ezh5m.live", "vh378qqwk9vc.live", "uamdjqdesjmn.live", "rfzo8fwm7pdw.live", "9gle7ejwpees.live", "26wem2p2aunb.live", "2ujyrqt4xzmp.live", "kg6w8hdimtgi.live", "dggn2tge08jf.live", "lygtfikzieri.live", "h8laq4jtyfqp.live", "u6ye5aivfq8b.live", "nwd3emyfsyin.live", "z3atxb3cfji3.live", "w00hvclrjhb1.live", "6mca3un8fmrd.live", "xv8ev6g1h4g3.live", "k1q1fkrd37n3.live", "btf4j310getp.live", "4p06saxn3ubp.live", "5aphqp78vw8h.live", "3r045r8mjwfp.live", "kwekpaz4eobt.live", "0eiko3lmbxbj.live", "8vxea0tldluf.live", "y2ec6qvepl7y.live", "5xlu80qs1ox1.live", "n3om81law5m7.live", "ei2svhuxkfnm.live", "kdye9rtnqezb.live", "boxoxs9gx6f5.live", "ktzb5e49zz1m.live", "ymz7vmrsh6eu.live", "x7dnaw133jnh.live", "hupacwlnz805.live", "1tlgdsxl0pqt.live", "3z5rr2y27c6j.live", "ufiiux335dpw.live", "vu32g1q7jvl3.live", "fkvo7y76r6cl.live", "aa8btew33mma.live", "yfpmjc270ree.live", "jrn2pbs4zh17.live", "7hxcfu85ux0c.live", "xkctmynb51ur.live", "16fpr15y5e2s.live", "lxck7t4mnvah.live", "2thp12dgf6rb.live", "vzq8xfz91x5d.live", "a0xjyxk6h5m7.live", "l8is8ftcfws6.live", "qtwfxhporina.live", "6lgie8q5pjdc.live", "12hpr97amca3.live", "ya8ym63w9m91.live", "kiph911rpr6p.live", "vmduug7itjpc.live", "q7bu8jglm22a.live", "9rfwwr2pkx4u.live", "0xejepvnnpze.live", "fd7cxsr946wv.live", "nsqum7l04ak6.live", "28hnsvxigwgm.live", "rlezxvz505nn.live", "r8o1vudqot70.live", "5ax9d1kvmld4.live", "fum22rxxfolh.live", "w525f7mmd4ms.live", "19pubdw7x197.live", "23k1m1uhe7kg.live", "w3d73cw4ayun.live", "e8y8k4xhyx42.live", "lsogs7k1lsrr.live", "vxcd26ui2k5o.live", "vlqwx3ydmtxh.live", "0vyvyfx6ymxv.live", "mrwrxcp86n8e.live", "dxwhiektvxsc.live", "zaig1x6gox2m.live", "l1whn6jhl8xi.live", "hwptyw6xppuu.live", "tkhk0evpw5wi.live", "tdcehfsov6o8.live", "0gylcs3gwdpp.live", "f7lj3cp91c5o.live", "op49rm7r54r1.live", "g8zydz0jz6bv.live", "m588j6oqsmyc.live", "jgckcltjx3q4.live", "gdo249s9ctn2.live", "1l7skmurzjhn.live", "08yr9hhkf9zh.live", "82oolxmgd19l.live", "3ipyuro17prh.live", "e7c1o9hymmkq.live", "i7teaxg9fq17.live", "vwz9poay9t88.live", "kaky1v99z650.live", "z7w1125qgaak.live", "ff7fsl0xpmig.live", "wwp2hnto3y50.live", "xj0airqray7d.live", "x39w37ihaw67.live", "a88mnb53f6ao.live", "agvzlu1xi8aq.live", "rigwjjv5e0te.live", "8f503mspar1t.live", "u86t183m8fjl.live", "n8r9e6f4eybg.live", "twh0pzti1jmc.live", "gxr3yjh3ez0o.live", "13gdw8hd0f5g.live", "u07wbc76jc3l.live", "hadsf1l0oorw.live", "vdx5gmp7hohn.live", "aho8skpvfpxw.live", "bd5sokdfx4rb.live", "di7gouks27ly.live", "9yvk5z9213sf.live", "k2xk3c8ka53h.live", "164kx6yftp7e.live", "p5dpz5k9s4hh.live", "2xokn358s23t.live", "9drofm4qhicr.live", "velmddsj68vd.live", "adu5tcdt1mw8.live", "s1hfevtelz76.live", "y1y2su385jdx.live", "yj4obmh1laef.live", "0i5mk5xlq0p0.live", "sbxmkuudcb2j.live", "bto73r7u8xfq.live", "57qrnj91bqd6.live", "ppakbng3anmz.live", "ydp5gh48yi5c.live", "lnksjujtesl1.live", "toooegs0ua4k.live", "uzpp0a72mgf8.live", "w0qtz6j8u8h0.live", "mmerhgt2a428.live", "k596zkzwcv8x.live", "j7hox858m1yw.live", "vt762jefdhwk.live", "kqofayjh1zst.live", "271bk6bm6ek7.live", "464ulfkbkxi6.live", "fpqzlfi32bhw.live", "x1glqki124qz.live", "4vh1mae0a37r.live", "28gh31g08o7w.live", "bsm3ushv2khf.live", "hxzt6iva3ycu.live", "k6ncoqtenmyi.live", "x7lbv7k4xmot.live", "i3ddusdlpj8z.live", "3yywf2zmb2m5.live", "xx6itd99vg7m.live", "dd9bojxysyeb.live", "u1uaoomqywpz.live", "r4feghmjdqmx.live", "bhkgnyvwctkm.live", "byx6cdkrouzc.live", "65ymc9fdwffj.live", "orp3efts3f5z.live", "2eiuyz0zf5qc.live", "p3840f9xv0n9.live", "8oz8f5ir0n5l.live", "i762u8xbamii.live", "j7hkay3ccvu5.live", "n4jcm1f5n25c.live", "exe12ldlj0nb.live", "z70o1vrhp5kt.live", "4tapo4p2dzqj.live", "9nsdtl72ktuk.live", "ipmh0eee13h2.live", "dg6aspb5wt99.live", "b5n5p7r75ln3.live", "va5rnvsffage.live", "z2ki56hqcxzx.live", "nketun9udno5.live", "v9hu15wlr3a3.live"], "DGA Seed": 18312320459530330518, "Domain Length": 300, "Domain Count": 12}| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_BumbleBee | Yara detected BumbleBee | Joe Security | ||
| Windows_Trojan_Bumblebee_35f50bea | unknown | unknown |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_BumbleBee | Yara detected BumbleBee | Joe Security | ||
| Windows_Trojan_Bumblebee_35f50bea | unknown | unknown |
| |
| JoeSecurity_BumbleBee | Yara detected BumbleBee | Joe Security | ||
| Windows_Trojan_Bumblebee_35f50bea | unknown | unknown |
|
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Malware Configuration Extractor: | ||