bumblebee | 12df68306288f11609ff1b5cac904fcaeab3f5561bcbf0f09c2bf439c6daeadc

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2022, 02:40

Target

wabPTLAqdTmbJu.bat
Size

1KB
MD5

9cf24d2ca62c63bf523c2ec835a26e9f
SHA1

6e665d29117d318abf8318beaac265818ee990c3
SHA256

9e847e0113ee63ea0bbb3e873a5a33013b45a249fb734a50bf16df986f9cfe4d
SHA512

0b19e3460218c43aa00c6244cc34aa6bf786e5157db61e7d5df1adb506cd6606c163b2c6392bc84129c16daa2eb74f8d3d32e769ca5d404807f2464cab3be5d1

Score

10^/10

Family

bumblebee

Botnet

15repl

23.108.57.200:443

103.144.139.158:443

23.106.160.52:443

rc4.plain

Blocklisted process makes network request 7 IoCs

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1044	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1044	2088	cmd.exe	82
PID 2088 wrote to memory of 1044	2088	cmd.exe	82

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\wabPTLAqdTmbJu.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\rundll32.exe
  rundll32 TdndchBWGClEyG.dll,appMainRun
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:1044

memory/1044-133-0x000001B51A320000-0x000001B51A469000-memory.dmp

Filesize
1.3MB

Download
memory/1044-134-0x000001B51A0A0000-0x000001B51A118000-memory.dmp

Filesize
480KB

Download