bumblebee | 81522724d0ca28989c5dd4bd6ed52c5461ba53ddee27b569246fa59bd9af13a3 | Triage

Analysis

max time kernel
145s
max time network
155s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-12-2022 18:46

Sharing

Report Analysis Logs

General

Target

aboutUs.dll
Size

1.5MB
MD5

829e1ae91a3362f708f6e9a9222279ed
SHA1

ae505fd299c6c75660f88c8710b00f1ab8d42766
SHA256

f70cbdde53a4bacee3410caf7666f303e6958f8d1d0fb678afbfa1093e38b4cb
SHA512

030226487b6d3ae2c53ff9729be731f692c798208e25024ea914cee14e9bfcc2edc94b31a54e355fcef93d6ee5d8c5a260b3621170a6b3b09f6553984eaf1299
SSDEEP

24576:rgKYrq1rE7F3C9oqxmLJL+bomVWFuf3qj8r3d1fyMJu3n9HGPXUtOZEkTuuqW:UKXQyKDLd+omgFuXJutHsnL

Score

10^/10

bumblebee 0712 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0712

C2

192.254.79.122:443

139.177.146.25:443

104.219.233.145:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 8 IoCs

flow	pid	Process
1	756	rundll32.exe
3	756	rundll32.exe
4	756	rundll32.exe
5	756	rundll32.exe
6	756	rundll32.exe
7	756	rundll32.exe
10	756	rundll32.exe
11	756	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
756	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aboutUs.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-54-0x0000000001FF0000-0x0000000002139000-memory.dmp

Filesize
1.3MB

Download
memory/756-55-0x0000000000190000-0x0000000000205000-memory.dmp

Filesize
468KB

Download