bumblebee | ca484520cfabc9c78add59a56122798772598be027479adafa02c56bb9973606

General

Target

order.lnk
Size

1KB
MD5

b72d56cfad5baae4998ed2cfd973d32f
SHA1

ec16c82eff62e4b1beba2f04c9f5ecb0c955e3da
SHA256

ac8e67644d7b6b6f0bd78522a3568c98fe386a23542f73a2ec1a3cff4f433684
SHA512

5513fc13e402538a953b6db220b5b784eadd2f5326fdedad3820c794981ca6d2c2c361da7898aec31b7fdf5f0723b3fec656b2e532fa7b8a7628471d8d7ab1d5

Score

10^/10

bumblebee 0612 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0612

C2

23.106.223.144:443

139.177.146.137:443

172.86.123.150:443

149.3.170.236:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Executes dropped EXE 1 IoCs

pid	Process
1756	oiv0I4ymqE.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1756	oiv0I4ymqE.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1756	oiv0I4ymqE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2004	schtasks.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4104	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4104	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 3980	4956	cmd.exe	82
PID 4956 wrote to memory of 3980	4956	cmd.exe	82
PID 3980 wrote to memory of 3408	3980	cmd.exe	83
PID 3980 wrote to memory of 3408	3980	cmd.exe	83
PID 3980 wrote to memory of 3144	3980	cmd.exe	84
PID 3980 wrote to memory of 3144	3980	cmd.exe	84
PID 3980 wrote to memory of 1756	3980	cmd.exe	85
PID 3980 wrote to memory of 1756	3980	cmd.exe	85
PID 3980 wrote to memory of 2004	3980	cmd.exe	87
PID 3980 wrote to memory of 2004	3980	cmd.exe	87
PID 3980 wrote to memory of 4104	3980	cmd.exe	88
PID 3980 wrote to memory of 4104	3980	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\order.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c matrix.bat
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K copy /y /b C:\Windows\System32\rundll32.exe C:\ProgramData\oiv0I4ymqE.exe
    3⤵
    PID:3408
- - C:\Windows\system32\xcopy.exe
    xcopy /h /y worldsex.dll C:\ProgramData
    3⤵
    PID:3144
- - C:\ProgramData\oiv0I4ymqE.exe
    "C:\ProgramData\oiv0I4ymqE.exe" C:\ProgramData\worldsex.dll,mainRngSet
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    PID:1756
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /create /tn "DesktopApps" /f /tr "cmd.exe /c C:\programdata\oiv0I4ymqE.exe C:\programdata\worldsex.dll,mainRngSet" /sc hourly /mo 1 /sd 01/01/2022 /st 00:00
    3⤵
    - Creates scheduled task(s)
    PID:2004
- - C:\Windows\system32\taskkill.exe
    taskkill /F /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\oiv0I4ymqE.exe

Filesize
70KB

MD5
ef3179d498793bf4234f708d3be28633

SHA1
dd399ae46303343f9f0da189aee11c67bd868222

SHA256
b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

SHA512
02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

Download Submit
C:\ProgramData\oiv0I4ymqE.exe

Filesize
70KB

MD5
ef3179d498793bf4234f708d3be28633

SHA1
dd399ae46303343f9f0da189aee11c67bd868222

SHA256
b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

SHA512
02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

Download Submit
C:\ProgramData\worldsex.dll

Filesize
832KB

MD5
e9574d9836286e631822e492a7b0d560

SHA1
911cab76f98b0701ee53a70d30faad9dfbdaae1c

SHA256
1436cd7b3ec8fc3941292fad31475711a89b050bd1d87cdbbbf2866394dad099

SHA512
3b0a8a1ef518f01c6bff5614c10c15ef9d0380854721f543e4da738f2fc47548a2992bebe9538e636f0b5ee672bde92fea0c768b64dea87ef137dc13454fcd8f

Download Submit
C:\ProgramData\worldsex.dll

Filesize
832KB

MD5
e9574d9836286e631822e492a7b0d560

SHA1
911cab76f98b0701ee53a70d30faad9dfbdaae1c

SHA256
1436cd7b3ec8fc3941292fad31475711a89b050bd1d87cdbbbf2866394dad099

SHA512
3b0a8a1ef518f01c6bff5614c10c15ef9d0380854721f543e4da738f2fc47548a2992bebe9538e636f0b5ee672bde92fea0c768b64dea87ef137dc13454fcd8f

Download Submit
memory/1756-142-0x0000021B4D8D0000-0x0000021B4DA19000-memory.dmp

Filesize
1.3MB

Download
memory/1756-143-0x0000021B4BEF0000-0x0000021B4BF65000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads