Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
17/11/2022, 02:40
General
-
Target
TdndchBWGClEyG.dll
-
Size
836KB
-
MD5
4ec372d945f4279858d8ed93a83154b8
-
SHA1
8c1818a64979a128808c971f5d66702fdf964660
-
SHA256
8533d14d0d29dc3534591363aab48c0857f855a416855042de18fc428a9adeb6
-
SHA512
8b5725b16875c372522a41ec9ef8839ccc45a3d4840176bab6bd527a4cac85490407fb8ccb8226f5b8be610127bc573ddd40872246ab4a72c85016089d25ecd3
-
SSDEEP
12288:EjFKLyV6iAV2xGu8AcsufT43mFdWOhV5dP4nODbBYRjRYBmCkvLBxa1FiTCci1JZ:EjFKOVBA/u8jPT2pOgOmpxndx3TCc
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
15repl
C2
23.108.57.200:443
103.144.139.158:443
23.106.160.52:443
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Blocklisted process makes network request 6 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TdndchBWGClEyG.dll,#11⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
480KB