Analysis
- max time kernel
1313s - max time network
1219s - platform
windows10-1703_x64 - resource
win10-20220901-en - resource tags
- submitted
09/11/2022, 20:44
General
- Target newfile26.xlsm
- Size 55KB
- Sample221109-zh55cscaa3
- SHA256 cb45fc44b2fe203c3825a5ed5342a82288e5517e5d5ed711297abf5a7541e616
Malware Config
Extracted
-
bumblebee
-
0411r
-
172.86.121.123:443
-
176.223.165.125:443
-
45.66.248.216:443
Signatures
- BumbleBee
BumbleBee is a webshell malware written in C++.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Downloads MZ/PE file
- Loads dropped DLL 2 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Program crash 2 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 28 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\newfile26.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 name.dll,SendData2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4880 -s 3883⤵
- Program crash
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32 name.dll,SendData2⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3656 -s 3883⤵
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
name.dll
name.dll
name.dll
memory/2356-315-0x000001ECE68D0000-0x000001ECE690C000-memory.dmp
memory/2356-296-0x000001ECE6330000-0x000001ECE6352000-memory.dmp
memory/2356-326-0x000001ECE6990000-0x000001ECE6A06000-memory.dmp
memory/3656-355-0x0000020342FC0000-0x0000020343036000-memory.dmp
memory/3656-354-0x0000020343180000-0x00000203432C9000-memory.dmp
memory/4880-287-0x000001E98F860000-0x000001E98F8D6000-memory.dmp
memory/4880-286-0x000001E98FAF0000-0x000001E98FC39000-memory.dmp
memory/4960-132-0x00007FFBEB590000-0x00007FFBEB5A0000-memory.dmp
memory/4960-120-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp
memory/4960-122-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp
memory/4960-123-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp
memory/4960-121-0x00007FFBEE9B0000-0x00007FFBEE9C0000-memory.dmp
memory/4960-133-0x00007FFBEB590000-0x00007FFBEB5A0000-memory.dmp