bumblebee | 44ed83c8c4c46d8311989ee46ee8cf044c709cccf89580b1758b21091fc44193 | Triage

Analysis

max time kernel
143s
max time network
151s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
15-11-2022 02:50

Sharing

Report Analysis Logs

General

Target

malicious/eXrZsNsGUlguMh.dll
Size

879KB
MD5

e898a8e758c6d5c8b187f3eeb136cbd2
SHA1

f7754fc36454c07ff7eda9845e3c615e419f804a
SHA256

3eebf8c9fa461f01a64d8d95bc5ec7dc3459f7c141f903f1cb6da7d77c4837b9
SHA512

e7dd7e9a2db71fa82846b460840bf22863aedb464dc65c71065993e33eda637e5901f2baf7503aae4d02831f59a7c90b616df8ef1a8e49609e3431b96435c45a
SSDEEP

24576:hnVr8xZQgnKd0b7/dfpgHiMequAvD2D6:hnVgEcK0/lJquF6

Score

10^/10

bumblebee 1411 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

1411

C2

107.189.13.247:443

64.44.102.241:443

54.37.130.24:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
1	1328	rundll32.exe
3	1328	rundll32.exe
4	1328	rundll32.exe
5	1328	rundll32.exe
6	1328	rundll32.exe
7	1328	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1328	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\malicious\eXrZsNsGUlguMh.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:1328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-54-0x0000000001F10000-0x0000000002059000-memory.dmp

Filesize
1.3MB

Download
memory/1328-55-0x0000000001D50000-0x0000000001DC8000-memory.dmp

Filesize
480KB

Download