bumblebee | 3fdf1be957886affcc289f411ab91d634bb46e1537fc5e58f72c70bbd376d528 | Triage

Analysis

max time kernel
148s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 19:02

Sharing

Report Analysis Logs

General

Target

bb.dll
Size

966KB
MD5

6e780435da8461940fc822f31b7368d2
SHA1

1f9467a1495ee143588e9b53f0a5b1ebe311d4b5
SHA256

0a4af4996a5f1c091cde6b18907c08fe31f373d7477d2f524161a45d130a1fac
SHA512

76d9bf6522278d9b9d7f3979bccbb894684cea1e87c034fcd71860e969fc367f6a7a42f67184296cdeb5f77a2893c307868f8bd0f6c4d0f548a09549b05833fe
SSDEEP

12288:+s+DiK3N/x/8rwMAImFetO29Qvnr7iL7/FXQ6e4HP5kGpmaJTWPa5bi5pguM649J:+FgxAIyDvn9kqCtwWi5iukff

Score

10^/10

bumblebee 0311t2 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0311t2

C2

39.65.8.170:443

103.144.139.156:443

107.189.30.231:443

91.245.254.101:443

194.135.33.127:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 7 IoCs

flow	pid	Process
1	364	rundll32.exe
3	364	rundll32.exe
4	364	rundll32.exe
5	364	rundll32.exe
6	364	rundll32.exe
7	364	rundll32.exe
8	364	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
364	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/364-54-0x0000000001F10000-0x0000000002059000-memory.dmp

Filesize
1.3MB

Download
memory/364-55-0x0000000001CC0000-0x0000000001D36000-memory.dmp

Filesize
472KB

Download