bumblebee | 4b46f3597b581e577e93abd1ebd24cba17af94a46d38d22ad3b6119724246005 | Triage

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 21:18

Sharing

Report Analysis Logs

General

Target

conceptions.dll
Size

883KB
MD5

d5b106db0aebeb2edceec3fb0f19c046
SHA1

95d23823714fe000403ff3ef32bf18e71949eab9
SHA256

4b46f3597b581e577e93abd1ebd24cba17af94a46d38d22ad3b6119724246005
SHA512

f206d6356cbf3a7115c9d3adc7fae85a56fd24d2c892cda2836848c98228e0cb4b00eb0124fccce729ad8a8e9dd2e9f4360f61a750c32df6c73507e36e2c96aa
SSDEEP

24576:2f6BQALM7DbRurHhQtfUt9D3cnVBQ8praeLyv2unUN74:2f6CALMt0hx3D36B7ZaersUNc

Score

10^/10

bumblebee 0211r trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0211r

C2

193.109.120.156:443

192.111.146.184:443

104.219.233.113:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
16	4888	rundll32.exe
21	4888	rundll32.exe
36	4888	rundll32.exe
41	4888	rundll32.exe
43	4888	rundll32.exe
44	4888	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4888	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\conceptions.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4888-132-0x0000023A1CEE0000-0x0000023A1D029000-memory.dmp

Filesize
1.3MB

Download
memory/4888-133-0x0000023A1B3D0000-0x0000023A1B446000-memory.dmp

Filesize
472KB

Download