bumblebee | a6a48f8c18172cd0acafce22a39fdc65a720aad346050a7ee1b20cd6a13bd3f8

Analysis

max time kernel
137s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2022 17:35

Target

pBLiwECeuZiHFL.bat
Size

1KB
MD5

ff1583c2c367477eb0873a15201cbcee
SHA1

8e24b760fdfa2e45eccf800644749b5942f79b4f
SHA256

c4730df817cb9010496afb25668619249e8e93a64d860783c7a49675c7c4fe0b
SHA512

ed2b5744269509359be16ae35dc08b9eb2ca1c8e4876de3605f2a7486774d16cbf8207288ec9d82c34ddd49f81f903618d996d91df65ac5a46792b5036867a12

Score

10^/10

Family

bumblebee

Botnet

0211

176.223.165.119:443

51.75.63.234:443

104.168.171.189:443

rc4.plain

Blocklisted process makes network request 7 IoCs

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1340	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 1340	616	cmd.exe	81
PID 616 wrote to memory of 1340	616	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pBLiwECeuZiHFL.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\system32\rundll32.exe
  rundll32 LDYwFaCKXIhkuX.dll,Qruncore
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:1340

memory/1340-133-0x000001CA197C0000-0x000001CA19909000-memory.dmp

Filesize
1.3MB

Download
memory/1340-134-0x000001CA19570000-0x000001CA195E6000-memory.dmp

Filesize
472KB

Download