bumblebee | 0b98bff25ebce8053e2c39214b3622b8d8666ae416afb52c5842312f27a6914f | Triage

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-11-2022 05:20

Sharing

Report Analysis Logs

General

Target

aGySCShDWxUsAj.dll
Size

881KB
MD5

1233a723ebdece80cb592aa584510066
SHA1

d52fe73050ba2b765dde5038db762b183641aee8
SHA256

0b98bff25ebce8053e2c39214b3622b8d8666ae416afb52c5842312f27a6914f
SHA512

69a8c85c71cc2450c336ee7f50bc00de8d4c953dcd8c7a34c87ab14db5a23a15bae7a87fb86923f54ddb4efcd518885f9b4c99d85738eeac0e349b4cffd90f43
SSDEEP

24576:1GpCocuZdWdqF9krwNlW5HtTPVEbzedDRSpN:1Gvcldqjkz5Nj+bz4DRSn

Score

10^/10

bumblebee 1411 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

1411

C2

107.189.13.247:443

64.44.102.241:443

54.37.130.24:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
1	736	rundll32.exe
3	736	rundll32.exe
4	736	rundll32.exe
5	736	rundll32.exe
6	736	rundll32.exe
7	736	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
736	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aGySCShDWxUsAj.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/736-54-0x0000000002060000-0x00000000021A9000-memory.dmp

Filesize
1.3MB

Download
memory/736-55-0x0000000000300000-0x0000000000378000-memory.dmp

Filesize
480KB

Download