bumblebee | 12df68306288f11609ff1b5cac904fcaeab3f5561bcbf0f09c2bf439c6daeadc

Analysis

max time kernel
130s
max time network
143s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17/11/2022, 02:40

Target

wabPTLAqdTmbJu.bat
Size

1KB
MD5

9cf24d2ca62c63bf523c2ec835a26e9f
SHA1

6e665d29117d318abf8318beaac265818ee990c3
SHA256

9e847e0113ee63ea0bbb3e873a5a33013b45a249fb734a50bf16df986f9cfe4d
SHA512

0b19e3460218c43aa00c6244cc34aa6bf786e5157db61e7d5df1adb506cd6606c163b2c6392bc84129c16daa2eb74f8d3d32e769ca5d404807f2464cab3be5d1

Score

10^/10

Family

bumblebee

Botnet

15repl

23.108.57.200:443

103.144.139.158:443

23.106.160.52:443

rc4.plain

Blocklisted process makes network request 6 IoCs

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
936	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 936	1416	cmd.exe	29
PID 1416 wrote to memory of 936	1416	cmd.exe	29
PID 1416 wrote to memory of 936	1416	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\wabPTLAqdTmbJu.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\system32\rundll32.exe
  rundll32 TdndchBWGClEyG.dll,appMainRun
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:936

memory/936-55-0x0000000001FC0000-0x0000000002109000-memory.dmp

Filesize
1.3MB

Download
memory/936-56-0x0000000001BA0000-0x0000000001C18000-memory.dmp

Filesize
480KB

Download