bumblebee | c80de52d42e21278610b0516bfcf4ebda136a5696af3f60a5e5782911e4276d0 | Triage

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2022 17:17

Sharing

Report Analysis Logs

General

Target

TA580_20221114.zip/aGySCShDWxUsAj.dll
Size

881KB
MD5

1233a723ebdece80cb592aa584510066
SHA1

d52fe73050ba2b765dde5038db762b183641aee8
SHA256

0b98bff25ebce8053e2c39214b3622b8d8666ae416afb52c5842312f27a6914f
SHA512

69a8c85c71cc2450c336ee7f50bc00de8d4c953dcd8c7a34c87ab14db5a23a15bae7a87fb86923f54ddb4efcd518885f9b4c99d85738eeac0e349b4cffd90f43
SSDEEP

24576:1GpCocuZdWdqF9krwNlW5HtTPVEbzedDRSpN:1Gvcldqjkz5Nj+bz4DRSn

Score

10^/10

bumblebee 1411 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

1411

C2

107.189.13.247:443

64.44.102.241:443

54.37.130.24:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
28	5060	rundll32.exe
33	5060	rundll32.exe
35	5060	rundll32.exe
38	5060	rundll32.exe
39	5060	rundll32.exe
40	5060	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5060	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\TA580_20221114.zip\aGySCShDWxUsAj.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:5060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5060-132-0x0000022731800000-0x0000022731949000-memory.dmp

Filesize
1.3MB

Download
memory/5060-133-0x0000022731640000-0x00000227316B8000-memory.dmp

Filesize
480KB

Download