Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2022, 21:18

General

  • Target

    conceptions.dll

  • Size

    883KB

  • MD5

    d5b106db0aebeb2edceec3fb0f19c046

  • SHA1

    95d23823714fe000403ff3ef32bf18e71949eab9

  • SHA256

    4b46f3597b581e577e93abd1ebd24cba17af94a46d38d22ad3b6119724246005

  • SHA512

    f206d6356cbf3a7115c9d3adc7fae85a56fd24d2c892cda2836848c98228e0cb4b00eb0124fccce729ad8a8e9dd2e9f4360f61a750c32df6c73507e36e2c96aa

  • SSDEEP

    24576:2f6BQALM7DbRurHhQtfUt9D3cnVBQ8praeLyv2unUN74:2f6CALMt0hx3D36B7ZaersUNc

Score
10/10

Malware Config

Extracted

Family

bumblebee

Botnet

0211r

C2

193.109.120.156:443

192.111.146.184:443

104.219.233.113:443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

  • Blocklisted process makes network request 6 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\conceptions.dll,#1
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of NtCreateThreadExHideFromDebugger
    PID:4888

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4888-132-0x0000023A1CEE0000-0x0000023A1D029000-memory.dmp

    Filesize

    1.3MB

  • memory/4888-133-0x0000023A1B3D0000-0x0000023A1B446000-memory.dmp

    Filesize

    472KB