bumblebee | a02b9ce9695dcf224e04b683973559c18aa3a6df8154c38646c5abee8d074e6b | Triage

Analysis

max time kernel
128s
max time network
141s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-11-2022 06:57

Sharing

Report Analysis Logs

General

Target

sample.dll
Size

1.4MB
MD5

38445646abd11b843c2b89593082cd4b
SHA1

46125264343b4ae45292c6186526ee1e46c2ffb6
SHA256

225fbedd5ed8d93e78a59a60955a4ae7bbe11476668699b2dc2a189508d6f493
SHA512

06985b3fb40781d1a0cf0c3a072f863141570b9e183dbd299f0a63889a9ee624c8de7342288e1f612580e5a439c41531ce14e27613f9f80f4e08e59a1f9eabc2
SSDEEP

24576:30vmdBQqlXGM+68I31p2v1Gyc10yLhkr1:30vSBQqlWMf31S1yLhk

Score

10^/10

bumblebee 0211 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0211

C2

176.223.165.119:443

51.75.63.234:443

104.168.171.189:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
1	1300	rundll32.exe
3	1300	rundll32.exe
4	1300	rundll32.exe
5	1300	rundll32.exe
6	1300	rundll32.exe
9	1300	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1300	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sample.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:1300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1300-54-0x00000000020C0000-0x0000000002209000-memory.dmp

Filesize
1.3MB

Download
memory/1300-55-0x0000000000190000-0x0000000000206000-memory.dmp

Filesize
472KB

Download