bumblebee | edeab0df9cab4c8bc33ffd3ef54c0576b39f6016655cc778334f4f6b8945977e

Analysis

max time kernel
133s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2022 22:37

Target

swBdvsXKmEsXgd.bat
Size

1KB
MD5

11571cb7543f27a669a315c59c6daa26
SHA1

0a7623689fcfb1d19fd51c4fa23fb3b83d0fce9e
SHA256

b4d367fcd6757019179b99220e5500277fae9cc13028771457edee23eeebe412
SHA512

ddc2f689d5480971195c3ae5a9083cfb6b7bc2568ce54a707f6fc7f67c0acf6c20a71a40ec3922cc66e2b08cf48e10a6855428dc658d278470ca4e4a72e6e369

Score

10^/10

Family

bumblebee

Botnet

0311

64.44.102.224:443

146.70.161.59:443

192.236.194.104:443

rc4.plain

Blocklisted process makes network request 6 IoCs

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4744	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4744	5036	cmd.exe	83
PID 5036 wrote to memory of 4744	5036	cmd.exe	83

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\swBdvsXKmEsXgd.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\system32\rundll32.exe
  rundll32 OyNrEOXqQnrBVp.dll,BasicLoad
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:4744

memory/4744-133-0x00000255A7B20000-0x00000255A7C69000-memory.dmp

Filesize
1.3MB

Download
memory/4744-134-0x00000255A7910000-0x00000255A7986000-memory.dmp

Filesize
472KB

Download