bumblebee | 9f8a878f09fe670c743eef7609473f6b520c77168297858eeb0f817aa6c73182 | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2022 17:10

Sharing

Report Analysis Logs

General

Target

maidservant/fungicides.dll
Size

884KB
MD5

4d6f7a198b0e5b36bab0853bd869a038
SHA1

7104ae833db89116494d49f7337884711effd30f
SHA256

5336c479d9f30d7fe3437966533095273e9646027ac66e0b085a2e0553a17db4
SHA512

817ae626ed32ddd544cd11494fbd02560e31f24dc7c9850b4c608079fe82fd7d63803633b7f6db3e5e4a2a2db38dff66a40fc7832c38d369155d959747dc99ee
SSDEEP

24576:0FH+atTmiSo+fdgOukrK+RASbUtQLItq+Lf:0FH+aJmp1rMSItmIw6

Score

10^/10

bumblebee 0211r trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0211r

C2

193.109.120.156:443

192.111.146.184:443

104.219.233.113:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
29	4300	rundll32.exe
55	4300	rundll32.exe
60	4300	rundll32.exe
65	4300	rundll32.exe
68	4300	rundll32.exe
71	4300	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4300	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\maidservant\fungicides.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4300-132-0x0000023273390000-0x00000232734D9000-memory.dmp

Filesize
1.3MB

Download
memory/4300-133-0x00000232731D0000-0x0000023273246000-memory.dmp

Filesize
472KB

Download