bumblebee | 4b46f3597b581e577e93abd1ebd24cba17af94a46d38d22ad3b6119724246005

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/11/2022, 21:18 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

conceptions.dll
Size

883KB
MD5

d5b106db0aebeb2edceec3fb0f19c046
SHA1

95d23823714fe000403ff3ef32bf18e71949eab9
SHA256

4b46f3597b581e577e93abd1ebd24cba17af94a46d38d22ad3b6119724246005
SHA512

f206d6356cbf3a7115c9d3adc7fae85a56fd24d2c892cda2836848c98228e0cb4b00eb0124fccce729ad8a8e9dd2e9f4360f61a750c32df6c73507e36e2c96aa
SSDEEP

24576:2f6BQALM7DbRurHhQtfUt9D3cnVBQ8praeLyv2unUN74:2f6CALMt0hx3D36B7ZaersUNc

Score

10^/10

bumblebee 0211r trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0211r

193.109.120.156:443

192.111.146.184:443

104.219.233.113:443

rc4.plain

1
vJsNUnInGR

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
1	2036	rundll32.exe
3	2036	rundll32.exe
4	2036	rundll32.exe
5	2036	rundll32.exe
6	2036	rundll32.exe
7	2036	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2036	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\conceptions.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:2036

Network

No results found

153.171.19.19:193

rundll32.exe

152 B
3
162.89.191.237:462

rundll32.exe

152 B
3
56.92.118.96:203

rundll32.exe

152 B
3
128.179.243.108:401

rundll32.exe

152 B
3
159.216.152.53:354

rundll32.exe

152 B
3
140.74.191.231:392

rundll32.exe

104 B
2

No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-54-0x0000000001FD0000-0x0000000002119000-memory.dmp

Filesize
1.3MB

Download
memory/2036-55-0x0000000000120000-0x0000000000196000-memory.dmp

Filesize
472KB

Download