Analysis
-
max time kernel
136s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
03-11-2022 22:37
General
-
Target
OyNrEOXqQnrBVp.dll
-
Size
966KB
-
MD5
bd16d730f650434ddbe551583c8eebf1
-
SHA1
ae2fb59b6dd326b29f4190d8bf20551567584a44
-
SHA256
c3b55562cdb4283d0745297ea25d7b14f774b41c14ae455d2b0c528327548869
-
SHA512
2a22937835526021e7ac3c3823b19108d89ebec8f576d69a497f86a9debbf20468a39b093fe146868374fc5c689f52f7444bf857eccc44df745ad4e37d79b7e4
-
SSDEEP
12288:ttBYC2oNS0DEYnl2P/VS2CGYqjkrKzQpdEZ8COwi7fJFmcnKzlI3ix50:ttqCtvwPtSeYrKCXjPmcnKzlzs
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
0311
C2
64.44.102.224:443
146.70.161.59:443
192.236.194.104:443
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Blocklisted process makes network request 6 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\OyNrEOXqQnrBVp.dll,#11⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
472KB