Keypoints
- Bumblebee acts as a replacement loader for BazarLoader, delivering frameworks like Cobalt Strike, Sliver, Meterpreter, and other malware variants.
- The infection chain begins with a spam email featuring a password-protected VHD attachment.
- The VHD contains Quote.lnk and imagedata.ps1; the LNK file executes imagedata.ps1 to load Bumblebee in memory via PowerShell.
- The first stage PowerShell loader hides execution (showshow) to evade antivirus detection using -ep bypass and ShowWindow.
<liThe PowerShell code obfuscates and base64-encodes streams, then decompresses and executes a second-stage PowerShell payload.
<liThe second stage uses PowerSploit Invoke-ReflectivePEInjection to reflectively load a DLL (LdrAddx64.dll) into the PowerShell process memory, enabling persistence/execution of the final payload.
MITRE Techniques
- [T1566] Phishing – The initial infection starts with a spam email that has a password-protected attachment that contains a .VHD (Virtual Hard Disk) extension file. ‘The initial infection starts with a spam email that has a password-protected attachment that contains a .VHD (Virtual Hard Disk) extension file.’
- [T1204] User Execution – The LNK shortcut file has the parameters to execute the file “imagedata.ps1”, which further loads the Bumblebee payload in the memory of the PowerShell. ‘The LNK shortcut file has the parameters to execute the file “imagedata.ps1”, which further loads the Bumblebee payload in the memory of the PowerShell.’
- [T1059] PowerShell – First Stage PowerShell Loader executes the payload via PowerShell. ‘C:WindowsSystem32WindowsPowerShellv1.0powershell.exe -ep bypass -file imagedata.ps1’
- [T1497] Virtualization/Sandbox Evasion – The loader hides execution to evade detection. ‘uses an alternate command, ShowWindow, to evade detection by Anti-virus scanners.’
- [T1027] Obfuscated Files or Information – The script obfuscates commands and concatenates strings; obfuscated Base64 streams are decoded later. ‘The PowerShell script contains strings that are split into multiple lines and concatenated later for execution… obfuscated Base64 encoded streams.’
- [T1518] Security Software Discovery – The malware accounts for anti-analysis and evasion techniques against security software. ‘to evade detection by Anti-virus scanners… ShowWindow’
- [T1082] System Information Discovery – The second stage collects system information during execution. ‘System Information Discovery’ (referenced in the MITRE mapping).
- [T1012] Query Registry – The malware queries registry to gather environment data. ‘Query Registry’ (referenced in the MITRE mapping).
- [T1055] Process Injection – The final DLL is injected into the PowerShell process memory via reflective loading. ‘The image below shows the code similarities between the second stage PowerShell script present in the memory of “PowerShell.exe” and the Invoke-ReflectivePEInjection code…’; ‘The DLL payload injected into the memory of Powershell process by using the Invoke-ReflectivePEInjection function.’
- [T1574] DLL Side-Loading – The embedded DLL is loaded into memory and executed within the PowerShell process. ‘reflectively loading the DLL into the PowerShell Process…’
- [T1027] Obfuscated/Encoded Data – The second stage uses obfuscated/encoded data streams and Base64 decoding before execution. ‘Obfuscated Base64 encoded streams’
- [T1018] Security Software Discovery (clarified in context as Security Software Discovery) – ‘Security Software Discovery’ appears in context of anti-analysis measures.
Indicators of Compromise
- [MD5] VHD file – 59fc33d849f9ad2ab4e4b7fe4b443a33 and 2 more (examples shown in article)
- [SHA1] VHD file – e4ed0f94e8ad9aeeb019e6d253e2eefa83b51b5a
- [SHA256] VHD file – 2102214c6a288819112b69005737bcfdf256730ac859e8c53c9697e3f87839f2
- [MD5] LNK file – b3b877f927898a457e35e4c6a6710d01
- [SHA1] LNK file – 8ed3dfa1ece8dbad0ccc8be8c1684f5a3de08ccb
- [SHA256] LNK file – 1285f03b8dbe35c82feef0cb57b3e9b24e75efabba0589752c2256a8da00ad85
- [MD5] PS1 file – Stage 1 – 254d757d0f176afa59ecea28822b3a71
- [SHA1] PS1 file – Stage 1 – 3e59fff860826055423dde5bbd8830cceae17cf3
- [SHA256] PS1 file – Stage 1 – 0ff8988d76fc6bd764a70a7a4f07a15b2b2c604138d9aadc784c9aeb6b77e275
- [MD5] PS1 file – Stage 2 – 225b9fb42b5879c143c56ef7402cbcbc
- [SHA1] PS1 file – Stage 2 – 03369886e9fc4b7eacc390045aa9c4b7fffad69a
- [SHA256] PS1 file – Stage 2 – db91155087bd2051b7ac0576c0994e9fffb5225c26ea134cb2f38e819f385730
- [MD5] Bumblebee DLL payload – da6feac8dff2a44784be3d078f2d4ac3
- [SHA1] Bumblebee DLL payload – c0f43d1d3e87b0e8b86b4b9e91cb55b4a1893b48
- [SHA256] Bumblebee DLL payload – 9bd9da44cc2d259b8c383993e2e05bbe1bcdac917db563b94e824b4b1628e87c
Read more: https://blog.cyble.com/2022/09/07/bumblebee-returns-with-new-infection-technique/