bumblebee | 6bd244fcf3711f5cba246dc3e3a2ca14855c849856a03cb700cb49fe85663de7

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13-02-2023 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

amateur.dll
Size

1.0MB
MD5

63f8c02fa87e750af09aad4f48b1aa4b
SHA1

f6554c45d574e960ed5f262779ff5aaeb928384e
SHA256

9a149522394b1718586436d43d72a9c9fece1f5c63478b6045b99421a35afecb
SHA512

017adaaf9791fd90906f2f0f7e713bd0ed48075cc2838247d730ef9411a0089f98fc6ad33d0813367dff486bb27e4a5fe4c8123f887f36deddd0f3f986a235e0
SSDEEP

24576:dTOm8Acqmr0tSEud7LgCgF1ZlPluqzGfGhu7h:dzcZotSwCgHEqzG+4

Score

10^/10

bumblebee 132lg trojan

Malware Config

Extracted

Family

bumblebee

Botnet

132lg

205.185.113.34:443

103.144.139.146:443

23.106.223.222:443

95.168.191.248:443

23.106.223.182:443

146.70.29.237:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 7 IoCs

flow	pid	Process
1	616	rundll32.exe
3	616	rundll32.exe
4	616	rundll32.exe
7	616	rundll32.exe
10	616	rundll32.exe
13	616	rundll32.exe
16	616	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
616	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\amateur.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-54-0x0000000001FB0000-0x0000000002111000-memory.dmp

Filesize
1.4MB

Download
memory/616-55-0x0000000001C30000-0x0000000001CAF000-memory.dmp

Filesize
508KB

Download