bumblebee | 6b80e48540df747828128560214ad00c66c7e0a0ce4118e53214d498481fe549 | Triage

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 21:35

Sharing

Report Analysis Logs

General

Target

melanin.dll
Size

883KB
MD5

0b83e514d3242d00e43c13d04555c6b7
SHA1

3d05b1005d36c70b7c4d9dc5ad3b4cb0455852f5
SHA256

6b80e48540df747828128560214ad00c66c7e0a0ce4118e53214d498481fe549
SHA512

e3e39bb21d5eab03ac703dfcd78782d8855b5ab07ff42b3bf8ed9f379663bbf52afd385ce609758e5ca96fc13f9026beeebfe9c1232c96663c3f6ac0285f1017
SSDEEP

24576:78uGvxcSwLS6SI4N6bagH1LG2VrFXO8U5sE+dzXV/C8Q:AuGpk4+FdGurFXO8U5s1dTV/C

Score

10^/10

bumblebee 0211r trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0211r

C2

193.109.120.156:443

192.111.146.184:443

104.219.233.113:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
27	1196	rundll32.exe
30	1196	rundll32.exe
33	1196	rundll32.exe
36	1196	rundll32.exe
37	1196	rundll32.exe
38	1196	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1196	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\melanin.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-132-0x0000026AA51A0000-0x0000026AA52E9000-memory.dmp

Filesize
1.3MB

Download
memory/1196-133-0x0000026AA35C0000-0x0000026AA3636000-memory.dmp

Filesize
472KB

Download