bumblebee | c80de52d42e21278610b0516bfcf4ebda136a5696af3f60a5e5782911e4276d0 | Triage

Analysis

max time kernel
130s
max time network
142s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-11-2022 17:17

Sharing

Report Analysis Logs

General

Target

TA580_20221114.zip/aGySCShDWxUsAj.dll
Size

881KB
MD5

1233a723ebdece80cb592aa584510066
SHA1

d52fe73050ba2b765dde5038db762b183641aee8
SHA256

0b98bff25ebce8053e2c39214b3622b8d8666ae416afb52c5842312f27a6914f
SHA512

69a8c85c71cc2450c336ee7f50bc00de8d4c953dcd8c7a34c87ab14db5a23a15bae7a87fb86923f54ddb4efcd518885f9b4c99d85738eeac0e349b4cffd90f43
SSDEEP

24576:1GpCocuZdWdqF9krwNlW5HtTPVEbzedDRSpN:1Gvcldqjkz5Nj+bz4DRSn

Score

10^/10

bumblebee 1411 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

1411

C2

107.189.13.247:443

64.44.102.241:443

54.37.130.24:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 5 IoCs

flow	pid	Process
1	868	rundll32.exe
3	868	rundll32.exe
4	868	rundll32.exe
5	868	rundll32.exe
6	868	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
868	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TA580_20221114.zip\aGySCShDWxUsAj.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:868

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-54-0x0000000001F50000-0x0000000002099000-memory.dmp

Filesize
1.3MB

Download
memory/868-55-0x00000000003A0000-0x0000000000418000-memory.dmp

Filesize
480KB

Download