bumblebee | 886eb38e77b5d5201507670852dd35b0c52ca09794f1e4dd2921b75453ce924c

Resubmissions

08-11-2022 19:50

221108-yklm3agahq 10

08-11-2022 19:00

221108-xn2m1scfg4 3

Analysis

max time kernel
167s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Scan_Document4852-(Nov8).iso
Size

1.0MB
MD5

bf64419cd700304a2b025571f1663bc0
SHA1

2b3ac60c3ace02bc7149b21b1fabe3ed8574e59c
SHA256

886eb38e77b5d5201507670852dd35b0c52ca09794f1e4dd2921b75453ce924c
SHA512

46812da6ecb036749dbf1efbc5afa98da5add5b6fe60a94d51e440a7bc7f3ffa3b23c4d418532f8c94455be26c33a241391fd9a3b4e5205b60b8c17bb4579398
SSDEEP

24576:4ZDtIk9GUX8zVzpSZe1Sn7xbRHCaGOGZ3Sz3y/0F+:mDtjBkwe1sdCaGp94Co

Score

10^/10

bumblebee 0811r trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0811r

176.223.165.108:443

146.19.253.28:443

146.70.149.38:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 4 IoCs

flow	pid	Process
52	1480	rundll32.exe
53	1480	rundll32.exe
55	1480	rundll32.exe
56	1480	rundll32.exe

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\E:	cmd.exe

Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs

pid	Process
1480	rundll32.exe
3728	rundll32.exe
2148	rundll32.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 4312	4404	cmd.exe	99
PID 4404 wrote to memory of 4312	4404	cmd.exe	99
PID 4312 wrote to memory of 4576	4312	cmd.exe	101
PID 4312 wrote to memory of 4576	4312	cmd.exe	101
PID 4312 wrote to memory of 1480	4312	cmd.exe	102
PID 4312 wrote to memory of 1480	4312	cmd.exe	102
PID 728 wrote to memory of 5088	728	cmd.exe	105
PID 728 wrote to memory of 5088	728	cmd.exe	105
PID 5088 wrote to memory of 1272	5088	cmd.exe	107
PID 5088 wrote to memory of 1272	5088	cmd.exe	107
PID 5088 wrote to memory of 3728	5088	cmd.exe	108
PID 5088 wrote to memory of 3728	5088	cmd.exe	108
PID 1952 wrote to memory of 516	1952	cmd.exe	112
PID 1952 wrote to memory of 516	1952	cmd.exe	112
PID 516 wrote to memory of 4580	516	cmd.exe	114
PID 516 wrote to memory of 4580	516	cmd.exe	114
PID 516 wrote to memory of 2148	516	cmd.exe	115
PID 516 wrote to memory of 2148	516	cmd.exe	115

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_Document4852-(Nov8).iso
1⤵
PID:5048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""E:\oxen\culling.cmd" "
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K oxen\coriander.cmd system rundl
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\system32\replace.exe
    replace C:\Windows\\system32\\rundll32.exe C:\Users\Admin\AppData\Local\Temp /A
    3⤵
    PID:4576
- - C:\Windows\system32\rundll32.exe
    rundll32.exe oxen\instal.jpg,PUpdate
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of NtCreateThreadExHideFromDebugger
    PID:1480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""E:\oxen\culling.cmd" "
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K oxen\coriander.cmd system rundl
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\system32\replace.exe
    replace C:\Windows\\system32\\rundll32.exe C:\Users\Admin\AppData\Local\Temp /A
    3⤵
    PID:1272
- - C:\Windows\system32\rundll32.exe
    rundll32.exe oxen\instal.jpg,PUpdate
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    PID:3728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""E:\oxen\culling.cmd" "
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K oxen\coriander.cmd system rundl
  2⤵
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\system32\replace.exe
    replace C:\Windows\\system32\\rundll32.exe C:\Users\Admin\AppData\Local\Temp /A
    3⤵
    PID:4580
- - C:\Windows\system32\rundll32.exe
    rundll32.exe oxen\instal.jpg,PUpdate
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-135-0x000001C122650000-0x000001C122799000-memory.dmp

Filesize
1.3MB

Download
memory/1480-136-0x000001C120B90000-0x000001C120C06000-memory.dmp

Filesize
472KB

Download
memory/2148-145-0x0000024407700000-0x0000024407849000-memory.dmp

Filesize
1.3MB

Download
memory/2148-146-0x0000024407540000-0x00000244075B6000-memory.dmp

Filesize
472KB

Download
memory/3728-140-0x000001C739D60000-0x000001C739EA9000-memory.dmp

Filesize
1.3MB

Download
memory/3728-141-0x000001C739B60000-0x000001C739BD6000-memory.dmp

Filesize
472KB

Download