bumblebee | da2b5721da210937936fff0991248b7e4acc5f15a3dcbaccca28705404f2ae05 | Triage

Analysis

max time kernel
102s
max time network
104s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
19-01-2023 16:38

Sharing

Report Analysis Logs

General

Target

storage.dll
Size

1.5MB
MD5

a9af7ea12a65c448f23e591416118c44
SHA1

573d94055a4318e7588e3e226f34d09c696e1902
SHA256

6361f2ba78f49ebdcfc8970ed581fc0f4764f7a03cb5c8a0362c59e05c4b51e6
SHA512

d47d00511389d8acd5654572631c669c2d83ce9b5dd6b78d09cd36ce95eee5275931939f2bdd7c0c84b08a427c30051440e43ca8b5a29245ac8e77c2bf4f6c97
SSDEEP

24576:8JZjTqXXuuulCzFw+rKpf1NA/TUIpvwfM15vfpdkazH:8J8WlCJvKA/wYfdkG

Score

10^/10

bumblebee 0812 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0812

C2

86.106.87.135:443

51.83.248.182:443

23.82.128.116:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3516	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3648	3516	WerFault.exe	65

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\storage.dll,#1
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:3516
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3516 -s 384
  2⤵
  - Program crash
  PID:3648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3516-116-0x000001ECC3860000-0x000001ECC38D5000-memory.dmp

Filesize
468KB

Download
memory/3516-117-0x000001ECC3A20000-0x000001ECC3B69000-memory.dmp

Filesize
1.3MB

Download
memory/3516-118-0x000001ECC3860000-0x000001ECC38D5000-memory.dmp

Filesize
468KB

Download