bumblebee | a02b9ce9695dcf224e04b683973559c18aa3a6df8154c38646c5abee8d074e6b | Triage

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2022 06:57

Sharing

Report Analysis Logs

General

Target

sample.dll
Size

1.4MB
MD5

38445646abd11b843c2b89593082cd4b
SHA1

46125264343b4ae45292c6186526ee1e46c2ffb6
SHA256

225fbedd5ed8d93e78a59a60955a4ae7bbe11476668699b2dc2a189508d6f493
SHA512

06985b3fb40781d1a0cf0c3a072f863141570b9e183dbd299f0a63889a9ee624c8de7342288e1f612580e5a439c41531ce14e27613f9f80f4e08e59a1f9eabc2
SSDEEP

24576:30vmdBQqlXGM+68I31p2v1Gyc10yLhkr1:30vSBQqlWMf31S1yLhk

Score

10^/10

bumblebee 0211 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0211

C2

176.223.165.119:443

51.75.63.234:443

104.168.171.189:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 7 IoCs

flow	pid	Process
24	2248	rundll32.exe
28	2248	rundll32.exe
33	2248	rundll32.exe
34	2248	rundll32.exe
36	2248	rundll32.exe
37	2248	rundll32.exe
38	2248	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2248	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sample.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:2248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2248-132-0x0000017392E60000-0x0000017392FA9000-memory.dmp

Filesize
1.3MB

Download
memory/2248-133-0x0000017392C80000-0x0000017392CF6000-memory.dmp

Filesize
472KB

Download