Analysis
-
max time kernel
141s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
11-02-2023 13:28
General
-
Target
c9eb997b9af05af641a3708b006e34e6a9a4e7755fca72205cd187110375e7ac.dll
-
Size
1.1MB
-
MD5
0754f0df91f71d2e36f234c3852b157b
-
SHA1
6af19eb260bae0f01d13e6d618d93d63eb82d7c5
-
SHA256
c9eb997b9af05af641a3708b006e34e6a9a4e7755fca72205cd187110375e7ac
-
SHA512
f944a79b5852c7b8280dc479e2d4fd06bb09bbdb566bc5cbb4dc8340477204139ec4b9b0acbee3b7e3a3b2bc73f869f1e1d691690a35c9e9f711ab17e43f9deb
-
SSDEEP
24576:UxhinDzFYOcJpi16vsYSPN93IlZn3oCwg8LKMYL31IQNV:6iDnYc16vJO9QoC1M2N
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
102lg
C2
146.70.29.237:443
205.185.113.34:443
23.106.223.182:443
103.144.139.146:443
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Blocklisted process makes network request 7 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c9eb997b9af05af641a3708b006e34e6a9a4e7755fca72205cd187110375e7ac.dll,stProgNew1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
508KB