bumblebee | 8e35ce0c3fcdc14d4e441812c7856bdf6428734d8cea0b6d7c075963a5b4b307 | Triage

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-11-2022 05:19

Sharing

Report Analysis Logs

General

Target

vEzFDEkEeKmEBW.dll
Size

2.2MB
MD5

672ef9a2359f36e0a9dcb0227944beeb
SHA1

0d3e1b517781983f7b58e7b6b83384e83e8eb640
SHA256

8e35ce0c3fcdc14d4e441812c7856bdf6428734d8cea0b6d7c075963a5b4b307
SHA512

cb0b3d497805e25187d1b411c677f4a84180b25a9f08ffb241e2731515537a980db2215b53e22f7db872e3b79b30b4a3615ece2a5127c075c2a5b1d205774dc8
SSDEEP

49152:+lU8yggsqIDwKXtjC+Nc1zQE5eFCUhVI/VocWPR5/rr23feAH/:8OLspjV1C3/VolfTrKeAf

Score

10^/10

bumblebee 2710vm trojan

Malware Config

Extracted

Family

bumblebee

Botnet

2710vm

C2

23.106.160.141:443

198.98.56.242:443

104.244.77.61:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
27	4856	rundll32.exe
34	4856	rundll32.exe
38	4856	rundll32.exe
40	4856	rundll32.exe
41	4856	rundll32.exe
42	4856	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4856	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\vEzFDEkEeKmEBW.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4856-132-0x000002D314C90000-0x000002D314DD9000-memory.dmp

Filesize
1.3MB

Download
memory/4856-133-0x000002D314B40000-0x000002D314C85000-memory.dmp

Filesize
1.3MB

Download