bumblebee | 51bb71bd446bd7fc03cc1234fcc3f489f10db44e312c9ce619b937fad6912656 | Triage

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2023 17:41

Sharing

Report Analysis Logs

General

Target

sample2.dll
Size

903KB
MD5

a740177df6f2918373d4e6f482b8c2e3
SHA1

4501edd7904033cfdee783c03af2df0db935be30
SHA256

51bb71bd446bd7fc03cc1234fcc3f489f10db44e312c9ce619b937fad6912656
SHA512

ec45deeffd340dafecd065d22823df9a6f7e3cbc03e64316b6b7433f051a060c610e2c2d3df03d33966b05b03183af56074cc81a8383bcbf8fb0e61dc22dad73
SSDEEP

24576:gYfSxQ6Gjq/v/PQ7fV+Hz9PuYWp9ToAbXjTA+JxN9QS:/fSqovPQ7Cs9FbTTAAbx

Score

10^/10

bumblebee tokdll trojan

Malware Config

Extracted

Family

bumblebee

Botnet

tokdll

C2

195.20.17.233:443

192.111.146.189:443

62.113.238.73:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 7 IoCs

flow	pid	Process
26	1932	rundll32.exe
34	1932	rundll32.exe
75	1932	rundll32.exe
92	1932	rundll32.exe
93	1932	rundll32.exe
94	1932	rundll32.exe
95	1932	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1932	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\sample2.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:1932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-132-0x000002D371E40000-0x000002D371FA1000-memory.dmp

Filesize
1.4MB

Download
memory/1932-133-0x000002D371BF0000-0x000002D371C6E000-memory.dmp

Filesize
504KB

Download