bumblebee | fbd403eb77a8afdd3c5036235e8afc3256b1da2c5cdc216f319e4fa71f898852 | Triage

Analysis

max time kernel
259s
max time network
361s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
08-12-2022 19:34

Sharing

Report Analysis Logs

General

Target

tutorials.dll
Size

1.5MB
MD5

955124cf3130441f0b93fa0c87c02137
SHA1

0acd91c4631f7643d0ad242665d1d7baadabab5f
SHA256

35afd5a5aadaab873a895fccf8bfaef61a68c1f364dc99f309f3c3b8c718d65d
SHA512

f6dce4ebb9e98f9bc68a29551575c4d0357d2322f0f1d35715317e6a6794d2ebdc8cd707b70d1e7f35c7ca2110aa3ed9aabacf7d0404a73ef54bafb108a871dd
SSDEEP

24576:yUwx8mbsebGYPZVnJop5CzD7FKNn7uaxECSirfDy:VwzwYtNJID

Score

10^/10

bumblebee 0812 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0812

C2

86.106.87.135:443

51.83.248.182:443

23.82.128.116:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 6 IoCs

flow	pid	Process
5	1920	rundll32.exe
6	1920	rundll32.exe
9	1920	rundll32.exe
12	1920	rundll32.exe
13	1920	rundll32.exe
16	1920	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1920	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\tutorials.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1920-54-0x00000000001F0000-0x0000000000265000-memory.dmp

Filesize
468KB

Download
memory/1920-55-0x0000000001F30000-0x0000000002079000-memory.dmp

Filesize
1.3MB

Download
memory/1920-56-0x00000000001F0000-0x0000000000265000-memory.dmp

Filesize
468KB

Download