Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
03-11-2022 22:29
General
-
Target
225fbedd5ed8d93e78a59a60955a4ae7bbe11476668699b2dc2a189508d6f493.dll
-
Size
1.4MB
-
MD5
38445646abd11b843c2b89593082cd4b
-
SHA1
46125264343b4ae45292c6186526ee1e46c2ffb6
-
SHA256
225fbedd5ed8d93e78a59a60955a4ae7bbe11476668699b2dc2a189508d6f493
-
SHA512
06985b3fb40781d1a0cf0c3a072f863141570b9e183dbd299f0a63889a9ee624c8de7342288e1f612580e5a439c41531ce14e27613f9f80f4e08e59a1f9eabc2
-
SSDEEP
24576:30vmdBQqlXGM+68I31p2v1Gyc10yLhkr1:30vSBQqlWMf31S1yLhk
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
0211
C2
176.223.165.119:443
51.75.63.234:443
104.168.171.189:443
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Blocklisted process makes network request 6 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\225fbedd5ed8d93e78a59a60955a4ae7bbe11476668699b2dc2a189508d6f493.dll,#11⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
472KB