Analysis
-
max time kernel
131s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
30-11-2022 14:33
General
-
Target
survey.dll
-
Size
879KB
-
MD5
4901cef8e715a3ccb26e30f116cb6c26
-
SHA1
06b139e9bc5d3d3089af8e342546e7bbc43b8a06
-
SHA256
e2d3186f0663527951e5cda5491540c28ef492c54adc31852ca81c27e6a0621b
-
SHA512
c7fdc80817a1e727ac9243bf656c307f9118a4c0536eb5cd7b690a784ca02083a0ade03cc740e7c6730da73d4788ea8ccaff151d88bee8c8d465538cdfb340f3
-
SSDEEP
12288:BqvXeaivnQ9HHK7fOlmPkOvszjIsAblDAoPkNhSZoBtlC406ZIjWzEFCXeIlso:Bq/eaivQ9HHDlE8jwl8HPS+tER6ocSo
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
2811
C2
146.19.173.45:443
154.188.162.149:443
108.62.118.206:443
85.239.54.145:443
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Blocklisted process makes network request 5 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\survey.dll,#11⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
468KB