Analysis
-
max time kernel
1799s -
max time network
1805s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 18:54
Static task
static1
Behavioral task
behavioral1
Sample
bb.dll
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
bb.dll
Resource
win10v2004-20220901-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
tps1.ps1
Resource
win7-20220812-en
windows7-x64
General
-
Target
tps1.ps1
-
Size
170B
-
MD5
299563c5074a9a77e4e0b85240d4237c
-
SHA1
ac5bdbe219f4da3378cc1ac27e9f8c6496bea970
-
SHA256
24610513b3eef44c19a79b0b769076ecdf7e0e25c556c0f5de5c50e18c29200b
-
SHA512
3768aa232326c4864c92326dc52b2fc8959e9e843ab8b22f78168fad033843e16759fdbe171bfcc2834f8d46bd61a6aa9ab0e68695237dc062eed284e8da5549
Malware Config
Extracted
bumblebee
0311t2
39.65.8.170:443
103.144.139.156:443
107.189.30.231:443
91.245.254.101:443
194.135.33.127:443
Signatures
-
Blocklisted process makes network request 64 IoCs
flow pid Process 5 4816 powershell.exe 24 1928 rundll32.exe 37 1928 rundll32.exe 42 1928 rundll32.exe 46 1928 rundll32.exe 47 1928 rundll32.exe 50 1928 rundll32.exe 51 1928 rundll32.exe 52 1928 rundll32.exe 53 1928 rundll32.exe 54 1928 rundll32.exe 56 1928 rundll32.exe 57 1928 rundll32.exe 59 1928 rundll32.exe 61 1928 rundll32.exe 66 1928 rundll32.exe 67 1928 rundll32.exe 68 1928 rundll32.exe 70 1928 rundll32.exe 71 1928 rundll32.exe 72 1928 rundll32.exe 73 1928 rundll32.exe 74 1928 rundll32.exe 75 1928 rundll32.exe 76 1928 rundll32.exe 78 1928 rundll32.exe 79 1928 rundll32.exe 80 1928 rundll32.exe 82 1928 rundll32.exe 83 1928 rundll32.exe 85 1928 rundll32.exe 86 1928 rundll32.exe 88 1928 rundll32.exe 89 1928 rundll32.exe 91 1928 rundll32.exe 92 1928 rundll32.exe 93 1928 rundll32.exe 94 1928 rundll32.exe 95 1928 rundll32.exe 96 1928 rundll32.exe 98 1928 rundll32.exe 99 1928 rundll32.exe 101 1928 rundll32.exe 102 1928 rundll32.exe 104 1928 rundll32.exe 105 1928 rundll32.exe 106 1928 rundll32.exe 107 1928 rundll32.exe 109 1928 rundll32.exe 111 1928 rundll32.exe 112 1928 rundll32.exe 114 1928 rundll32.exe 115 1928 rundll32.exe 117 1928 rundll32.exe 118 1928 rundll32.exe 119 1928 rundll32.exe 121 1928 rundll32.exe 122 1928 rundll32.exe 124 1928 rundll32.exe 125 1928 rundll32.exe 126 1928 rundll32.exe 128 1928 rundll32.exe 129 1928 rundll32.exe 131 1928 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
pid Process 1928 rundll32.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1928 rundll32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\windows\tasks\bb.dll powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4816 powershell.exe 4816 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4816 powershell.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4816 wrote to memory of 1928 4816 powershell.exe 81 PID 4816 wrote to memory of 1928 4816 powershell.exe 81
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\tps1.ps11⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" /s c:\windows\tasks\bb.dll,BasicLoad2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:1928
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
966KB
MD56e780435da8461940fc822f31b7368d2
SHA11f9467a1495ee143588e9b53f0a5b1ebe311d4b5
SHA2560a4af4996a5f1c091cde6b18907c08fe31f373d7477d2f524161a45d130a1fac
SHA51276d9bf6522278d9b9d7f3979bccbb894684cea1e87c034fcd71860e969fc367f6a7a42f67184296cdeb5f77a2893c307868f8bd0f6c4d0f548a09549b05833fe
-
Filesize
966KB
MD56e780435da8461940fc822f31b7368d2
SHA11f9467a1495ee143588e9b53f0a5b1ebe311d4b5
SHA2560a4af4996a5f1c091cde6b18907c08fe31f373d7477d2f524161a45d130a1fac
SHA51276d9bf6522278d9b9d7f3979bccbb894684cea1e87c034fcd71860e969fc367f6a7a42f67184296cdeb5f77a2893c307868f8bd0f6c4d0f548a09549b05833fe