bumblebee | e4a011517eeb68f8c76e39a7d760454cb47a8b45a83453a18c8814706c758bbc

Analysis

max time kernel
124s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2022, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

img.img
Size

2.0MB
MD5

124287ed57e94dc2789efb4a92c5423b
SHA1

15926067aa84318dcb8591e3a6e105f3e7d21663
SHA256

e4a011517eeb68f8c76e39a7d760454cb47a8b45a83453a18c8814706c758bbc
SHA512

60096e0cc1cd82ba0d8f4d5b44e511bb21e438f0de28ea1244683dbb9d82b07e8bf5312553d95ec6567074ae60a9610232b77b591e95779fd1289bfc037ccf48
SSDEEP

24576:CIoU6IqOguEm4hw7FElkbaapvI++0MdkLwjhE:MUvg+4K7FElkbaauMw+

Score

10^/10

bumblebee 0911i trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0911i

64.44.101.25:443

146.70.100.80:443

51.83.225.143:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 5 IoCs

flow	pid	Process
59	4036	rundll32.exe
74	4036	rundll32.exe
75	4036	rundll32.exe
81	4036	rundll32.exe
87	4036	rundll32.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	cmd.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4036	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3268	4676	WerFault.exe	83

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2164	cmd.exe
Token: SeManageVolumePrivilege	2164	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4036	5076	cmd.exe	88
PID 5076 wrote to memory of 4036	5076	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\img.img
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4860

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c YmKvzBdwNZxeyC.bat
1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\system32\rundll32.exe
  rundll32 voWJIWdbqIwInO.dll,sctrun
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:4036

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 440 -p 4676 -ip 4676
1⤵
PID:3552

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4676 -s 1780
1⤵
- Program crash
PID:3268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4036-133-0x00000144BB820000-0x00000144BB969000-memory.dmp

Filesize
1.3MB

Download
memory/4036-134-0x00000144BB650000-0x00000144BB6C3000-memory.dmp

Filesize
460KB

Download