bumblebee | 3fdf1be957886affcc289f411ab91d634bb46e1537fc5e58f72c70bbd376d528 | Triage

Analysis

max time kernel
157s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 19:02

Sharing

Report Analysis Logs

General

Target

bb.dll
Size

966KB
MD5

6e780435da8461940fc822f31b7368d2
SHA1

1f9467a1495ee143588e9b53f0a5b1ebe311d4b5
SHA256

0a4af4996a5f1c091cde6b18907c08fe31f373d7477d2f524161a45d130a1fac
SHA512

76d9bf6522278d9b9d7f3979bccbb894684cea1e87c034fcd71860e969fc367f6a7a42f67184296cdeb5f77a2893c307868f8bd0f6c4d0f548a09549b05833fe
SSDEEP

12288:+s+DiK3N/x/8rwMAImFetO29Qvnr7iL7/FXQ6e4HP5kGpmaJTWPa5bi5pguM649J:+FgxAIyDvn9kqCtwWi5iukff

Score

10^/10

bumblebee 0311t2 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0311t2

C2

39.65.8.170:443

103.144.139.156:443

107.189.30.231:443

91.245.254.101:443

194.135.33.127:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
32	4532	rundll32.exe
46	4532	rundll32.exe
57	4532	rundll32.exe
63	4532	rundll32.exe
64	4532	rundll32.exe
68	4532	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4532	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4532

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4532-132-0x0000025011D00000-0x0000025011E49000-memory.dmp

Filesize
1.3MB

Download
memory/4532-133-0x0000025011B40000-0x0000025011BB6000-memory.dmp

Filesize
472KB

Download