bumblebee | 6b2e4c9b0579938ce73bd39874b58a8f67c24f49a188f1f0ae6bcde26fb8b084

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2022, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eLWCBMEWwlzsBt.bat
Size

1KB
MD5

a8071866320d5925502c2126defdd8e7
SHA1

c27c9e20cb2d75604e4eb706ef1532c45652e1ad
SHA256

a466d8918e30568b17a4e8e35a658070d525a6742a4e211b031e0daec7277a2b
SHA512

588af1181f3b85145f29d8b7c12de425d0285d76d7fdf25a04a097ae5c97556cd9f45fdc3d003c8d2af66fcdd5f0c35db82bae0f4a5daff596ad9953e0f5eee0

Score

10^/10

bumblebee 0111 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0111

102.151.221.33:443

104.244.77.61:443

212.114.52.124:443

23.106.160.141:443

198.98.56.242:443

23.108.57.5:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
25	4764	rundll32.exe
43	4764	rundll32.exe
45	4764	rundll32.exe
46	4764	rundll32.exe
47	4764	rundll32.exe
48	4764	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4764	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 4764	1048	cmd.exe	83
PID 1048 wrote to memory of 4764	1048	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\eLWCBMEWwlzsBt.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\system32\rundll32.exe
  rundll32 BOiQKiECaUzWqF.dll,RemoveSettings
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:4764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4764-133-0x000001CE30A00000-0x000001CE30A76000-memory.dmp

Filesize
472KB

Download
memory/4764-134-0x000001CE30BC0000-0x000001CE30D09000-memory.dmp

Filesize
1.3MB

Download
memory/4764-135-0x000001CE30A00000-0x000001CE30A76000-memory.dmp

Filesize
472KB

Download