Threat Research

BumbleBee a New Modular Backdoor Evolved From BookWorm

Securonix

BumbleBee is described as a refactored, modular backdoor evolved from BookWorm, featuring a two-app architecture (server/controller and client/slave) with layered deployment and a loader chain that uses a legitimate executable to run shellcode. The campaign appears targeted at Taiwan’s local government devices and expands capabilities via a controller app, using RC4/LZO for C2 communications and multiple persistence and control options. #BumbleBee #BookWorm #Taiwan #XecureIO_v20 #XcrSvr

Keypoints

  • BumbleBee comprises two applications: a master server (controller) and a slave client, enabling centralized command and control.
  • The client uses a layered, self-extracting package that loads a legitimate XcrSvr.exe with a side-loaded XecureIO_v20.dll to execute malicious shellcode (ore).
  • A set of modules (launcher.dll, kernel.dll, installer.dll, keylog.dll, loader.dll, slaver.dll) is loaded to perform actions after initial compromise.
  • Persistence is achieved via multiple methods, including registry run keys, Windows services, and logon initialization scripts (UserInitMprLogonScript).
  • The server provides extensive capabilities (file management, remote desktop, process/service/registry management, shell access, reverse proxy, and keylogging) for remote control.

    • <liNetwork traffic is encrypted with RC4 and compressed with LZO; initial beacon uses HTTP POST to /update, with payload integrity checked via a CRC32 scheme.

  • Attribution links BumbleBee to BookWorm and Chinese-origin threats, focusing on local government targets in Asia, particularly Taiwan.

MITRE Techniques

  • [T1574.002] Hijack Execution Flow: DLL Side-Loading – The loader DLL patches the parent entry point to run malicious code. “Notably, as XecureIO_v20.dll is loaded by XcrSvr.exe, it will check if the parent process is “XcrSvr.exe.” If so, it will patch the entry point of XcrSvr.exe with a long jump instruction to direct execution flow to the malicious code.”
  • [T1070.004] Indicator Removal on Host: File Deletion – The installer component drops and then deletes the original SFX payload to avoid analysis. “Delete the original SFX file.”
  • [T1055] Process Injection – XecureIO_v20.dll hooks its parent process’ entry point to route execution to malicious code. “XecureIO_v20.dll hooks its parent process’ entry point”
  • [T1480.001] Execution Guardrails: Environmental Keying – The payload is decrypted using machine-specific data (ProductID from registry) as the key. “Using the information on the compromised machine as a key to decrypt the encrypted payload”
  • [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Abuse registry run key for persistence on boot. “Abuse registry run key to repeatedly execute the malware once system boot”
  • [T1037.001] Boot or Logon Initialization Scripts: Logon Script (Windows) – Persistence through logon scripts. “Boot or Logon Initialization Scripts: Logon Script (Windows)”
  • [T1548.003] Create or Modify System Process: Windows Service – Create Windows services to repeatedly execute payloads. “Create Windows services to repeatedly execute malicious payloads”
  • [T1548.002] Abuse Elevation Control Mechanism: Bypass User Account Control – Bypass UAC via loaded components. “bpu.dll (used to bypass UAC)”
  • [T1056.001] Input Capture: Keylogging – Keylogger component records keystrokes and clipboard content. “Keylog.dll … monitors the keystrokes and clipboard content”
  • [T1592] Gather Victim Host Information – The server collects machine details (name, IP, location, OS, CPU, memory). “computer name, external IP address, geographic location, OS, CPU, and memory”
  • [T1071.001] Application Layer Protocol: Web Protocols – Communications occur over HTTP with a beacon to the C2. “Communicates over the HTTP protocol” and “POST request … /update”
  • [T1090] Proxy – Reverse proxy to expose a local server behind NAT/firewall. “Reverse proxy to help expose a local server behind a NAT or firewall to the internet”
  • [T1573.001] Encrypted Channel: Symmetric Cryptography – C2 traffic encrypted with RC4 and compressed with LZO. “encrypted between server and client applications using the RC4 and compressed by LZO”
  • [T1132.001] Data Encoding: Standard Encoding – Data is encrypted/encoded during transit (RC4) and using a CRC for integrity checks. “CRC32 checksum with reversed-presentation mode to verify the received data” and “encrypted … RC4”
  • [T1587.001] Develop Capabilities: Malware – The platform’s modular design enables ongoing capability development. “Develop Capabilities: Malware”

Indicators of Compromise

  • [Hash] – Context: associated with the backdoor components – f8809c6c56d2a0f8a08fe181614e6d9488eeb6983f044f2e6a8fa6a617ef2475, ea5db8d658f42acad38106cbc46eea5944607eb709fb00f8adb501d4779fbea0
  • [File name] – Context: files involved in payload delivery – slaver.exe, XecureIO_v20.dll
  • [Hash] – Context: additional module hashes for XecureIO_v20.dll – 3fc6c5df4a04d555d5cbf2ca53bed7769b5595fc6143a2599097cb6193ef8810
  • [Hash] – Context: additional module payloads – 4ecde81a476f1e4622d192fe2f120f7c5c3ec58bf118b791d5532f3ff61c09ee, 8ab8bb836b074e170c129b7f0523d256930fd1f8cf126ca1875b450fdb6c4c05, 8e340746339614ca105a1873dad471188b24421648d080e37d52b87f4ced5e6d
  • [File name] – Context: payload components – ore, bin, path
  • [URL] – Context: C2 endpoints – http://www.synolo.ns01.biz:80/update, http://118.163.105.130:80/update

Read more: https://www.trendmicro.com/en_us/research/22/i/buzzing-in-the-background-bumblebee-a-new-modular-backdoor-evolv.html