Overview

overview

10

Static

static

10

7751a09b3c...eb.dll

windows7-x64

10

7751a09b3c...eb.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-01-2023 19:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7751a09b3c1146b5db72be1218287da6fd4c65813a1eb9ae5e0389db879daaeb.dll

  • Size

    1.4MB

  • MD5

    12a99f8ae458862da2eddfb661ae7ced

  • SHA1

    f5f31414a29dac9e35888cd48a980d702f99fe70

  • SHA256

    7751a09b3c1146b5db72be1218287da6fd4c65813a1eb9ae5e0389db879daaeb

  • SHA512

    660032ffdb21aebda0ac30d363b198dab70187c3848c3e9c727f02b00e5ecd351bc85e1bd5b2fb4d568a90c2ce5ad2a058e20b42d0aaff4b12bcb46cfee58526

  • SSDEEP

    24576:g1GayIeFrnKgVGPCXr++xDTku+h5UZasJ2QfeFDXTZ9DztMa:ZQgVsCXfgu+h5UFpGFDN9D6a

Score
10/10
bumblebeehsyishsmqutrojan

Malware Config

Extracted

Family

bumblebee

Botnet

HsyIsHsmQu

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\7751a09b3c1146b5db72be1218287da6fd4c65813a1eb9ae5e0389db879daaeb.dll,#1
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    PID:2564

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2564-132-0x000001E44CD00000-0x000001E44CE75000-memory.dmp

    Filesize

    1.5MB

    Download