bumblebee | edeab0df9cab4c8bc33ffd3ef54c0576b39f6016655cc778334f4f6b8945977e

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-11-2022 22:37

Target

swBdvsXKmEsXgd.bat
Size

1KB
MD5

11571cb7543f27a669a315c59c6daa26
SHA1

0a7623689fcfb1d19fd51c4fa23fb3b83d0fce9e
SHA256

b4d367fcd6757019179b99220e5500277fae9cc13028771457edee23eeebe412
SHA512

ddc2f689d5480971195c3ae5a9083cfb6b7bc2568ce54a707f6fc7f67c0acf6c20a71a40ec3922cc66e2b08cf48e10a6855428dc658d278470ca4e4a72e6e369

Score

10^/10

Family

bumblebee

Botnet

0311

64.44.102.224:443

146.70.161.59:443

192.236.194.104:443

rc4.plain

Blocklisted process makes network request 6 IoCs

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1152	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1152	756	cmd.exe	28
PID 756 wrote to memory of 1152	756	cmd.exe	28
PID 756 wrote to memory of 1152	756	cmd.exe	28

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\swBdvsXKmEsXgd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\system32\rundll32.exe
  rundll32 OyNrEOXqQnrBVp.dll,BasicLoad
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:1152

memory/1152-55-0x00000000020C0000-0x0000000002209000-memory.dmp

Filesize
1.3MB

Download
memory/1152-56-0x00000000001B0000-0x0000000000226000-memory.dmp

Filesize
472KB

Download