bumblebee | 44ed83c8c4c46d8311989ee46ee8cf044c709cccf89580b1758b21091fc44193 | Triage

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/11/2022, 02:52

Sharing

Report Analysis Logs

General

Target

malicious/eXrZsNsGUlguMh.dll
Size

879KB
MD5

e898a8e758c6d5c8b187f3eeb136cbd2
SHA1

f7754fc36454c07ff7eda9845e3c615e419f804a
SHA256

3eebf8c9fa461f01a64d8d95bc5ec7dc3459f7c141f903f1cb6da7d77c4837b9
SHA512

e7dd7e9a2db71fa82846b460840bf22863aedb464dc65c71065993e33eda637e5901f2baf7503aae4d02831f59a7c90b616df8ef1a8e49609e3431b96435c45a
SSDEEP

24576:hnVr8xZQgnKd0b7/dfpgHiMequAvD2D6:hnVgEcK0/lJquF6

Score

10^/10

bumblebee 1411 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

1411

C2

107.189.13.247:443

64.44.102.241:443

54.37.130.24:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
2	904	rundll32.exe
6	904	rundll32.exe
7	904	rundll32.exe
10	904	rundll32.exe
13	904	rundll32.exe
14	904	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
904	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\malicious\eXrZsNsGUlguMh.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-54-0x0000000002080000-0x00000000021C9000-memory.dmp

Filesize
1.3MB

Download
memory/904-55-0x0000000001C30000-0x0000000001CA8000-memory.dmp

Filesize
480KB

Download