bumblebee | e107a5182ba2130a4f46d2825e5acf8f6e847c9beef055eead5baafbf86731f0 | Triage

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2022 18:06

Sharing

Report Analysis Logs

General

Target

pFTLNjSsgkkKZo.dll
Size

878KB
MD5

07b711458d0b4240267f7e47b50075d1
SHA1

e2e9feb1b42562cb1f22685667f8299dcdf10042
SHA256

42a63fe8c0d8f9c2fa090a69d85f5e5b35beef468b58912db56c78dcde79a929
SHA512

68fe82b71fc8e063642653a57fd2fe5580c233f22a4b17b4e5fc95456c7c96cd23a389b614d8d225c33f174c376795e55ebb409159ed5473a4f5d005bd933434
SSDEEP

24576:9IRXooWOMQ4569PPkHHPplBDVaYRxH6df30Ra2HN7:9I5XWOZw6hMnBlbamH6dc1N7

Score

10^/10

bumblebee 1411 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

1411

C2

107.189.13.247:443

64.44.102.241:443

54.37.130.24:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
76	4528	rundll32.exe
81	4528	rundll32.exe
84	4528	rundll32.exe
86	4528	rundll32.exe
87	4528	rundll32.exe
89	4528	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4528	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pFTLNjSsgkkKZo.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4528

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4528-132-0x000002B576120000-0x000002B576269000-memory.dmp

Filesize
1.3MB

Download
memory/4528-133-0x000002B574570000-0x000002B5745E8000-memory.dmp

Filesize
480KB

Download