Resubmissions

08-11-2022 21:43

221108-1k85gabggm 10

08-11-2022 21:40

221108-1jawaaabb5 10

Analysis

  • max time kernel
    1823s
  • max time network
    1838s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-11-2022 21:43

General

  • Target

    Scan_Document9698-(Nov8).iso

  • Size

    1.0MB

  • MD5

    2c0525c54018babb42a4c123bb8a9944

  • SHA1

    3ba334b1ddcbc1375477bf382db3b82e87b3a425

  • SHA256

    4797a2010eb6788cf55cd1f8a70e732770e136cc34aafcd973d536c98f52f649

  • SHA512

    a4409e154cf56691ec89ac92ab4f111f1c2aa0d1c209be72b7e27cf5570546012e66621c77884b5d0b712ab799846d26f6f8707e62321cec4020a655de0475a8

  • SSDEEP

    24576:2L6kLUpp+h2wCb2T/C6gndKfFG7GcIvUXVETg:2LlLCKPbkn23

Score
10/10

Malware Config

Extracted

Family

bumblebee

Botnet

0811r

C2

176.223.165.108:443

146.19.253.28:443

146.70.149.38:443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

  • Blocklisted process makes network request 64 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_Document9698-(Nov8).iso
    1⤵
      PID:2724
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4876
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "E:\oxen\fixture.cmd"
        1⤵
        • Enumerates connected drives
        • Suspicious use of WriteProcessMemory
        PID:2668
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /K oxen\ufo.cmd system rundl
          2⤵
          • Enumerates connected drives
          • Suspicious use of WriteProcessMemory
          PID:3300
          • C:\Windows\system32\replace.exe
            replace C:\Windows\\system32\\rundll32.exe C:\Users\Admin\AppData\Local\Temp /A
            3⤵
              PID:1880
            • C:\Windows\system32\rundll32.exe
              rundll32.exe oxen\dusty.jpg,PUpdate
              3⤵
              • Blocklisted process makes network request
              • Suspicious use of NtCreateThreadExHideFromDebugger
              PID:532

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/532-135-0x0000019F95DA0000-0x0000019F95EE9000-memory.dmp

          Filesize

          1.3MB

        • memory/532-136-0x0000019F941C0000-0x0000019F94236000-memory.dmp

          Filesize

          472KB