bumblebee | da2b5721da210937936fff0991248b7e4acc5f15a3dcbaccca28705404f2ae05 | Triage

Analysis

max time kernel
74s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2023 16:38

Sharing

Report Analysis Logs

General

Target

storage.dll
Size

1.5MB
MD5

a9af7ea12a65c448f23e591416118c44
SHA1

573d94055a4318e7588e3e226f34d09c696e1902
SHA256

6361f2ba78f49ebdcfc8970ed581fc0f4764f7a03cb5c8a0362c59e05c4b51e6
SHA512

d47d00511389d8acd5654572631c669c2d83ce9b5dd6b78d09cd36ce95eee5275931939f2bdd7c0c84b08a427c30051440e43ca8b5a29245ac8e77c2bf4f6c97
SSDEEP

24576:8JZjTqXXuuulCzFw+rKpf1NA/TUIpvwfM15vfpdkazH:8J8WlCJvKA/wYfdkG

Score

10^/10

bumblebee 0812 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

0812

C2

86.106.87.135:443

51.83.248.182:443

23.82.128.116:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 3 IoCs

flow	pid	Process
38	536	rundll32.exe
45	536	rundll32.exe
57	536	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
536	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\storage.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-132-0x000001B1A5210000-0x000001B1A5359000-memory.dmp

Filesize
1.3MB

Download
memory/536-133-0x000001B1A4FB0000-0x000001B1A5025000-memory.dmp

Filesize
468KB

Download