bumblebee | 05e26546200479529011d3500d17694e8ff14a7acaf1a229c5e28ab13ed22c99

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2023 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

contribute.dll
Size

2.2MB
MD5

a719d4ef0765ba845179d9819c37c061
SHA1

9aa9bc1b5707bddcbfbdbf5f8d24e477428d59af
SHA256

05e26546200479529011d3500d17694e8ff14a7acaf1a229c5e28ab13ed22c99
SHA512

237075e8115de5fde24dae339e6ddc3d2540993b8c420f16a8995d63b3b2628f62088c0d4327dd1f98f63d83ed74f9c1fe83ee722db549f53876e65c45f921f0
SSDEEP

49152:jpjKPCexHdaV5UT0PbDTQfWPjgH3/OiU7H1OXQ:jp2qeHdIST0PPTNPjIHU7HEXQ

Score

10^/10

bumblebee 132cc trojan

Malware Config

Extracted

Family

bumblebee

Botnet

132cc

173.234.155.246:443

172.86.120.111:443

31.232.16.192:443

205.185.113.34:443

103.175.16.104:443

23.254.167.63:443

23.82.140.155:443

51.68.144.43:443

185.173.34.35:443

104.168.157.253:443

146.19.173.86:443

160.20.147.242:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 8 IoCs

flow	pid	Process
11	5072	rundll32.exe
27	5072	rundll32.exe
39	5072	rundll32.exe
40	5072	rundll32.exe
42	5072	rundll32.exe
44	5072	rundll32.exe
45	5072	rundll32.exe
46	5072	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5072	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\contribute.dll,DllRegisterServer
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:5072

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5072-132-0x0000023C535B0000-0x0000023C53711000-memory.dmp

Filesize
1.4MB

Download
memory/5072-133-0x0000023C53450000-0x0000023C535B0000-memory.dmp

Filesize
1.4MB

Download