bumblebee | 9a149522394b1718586436d43d72a9c9fece1f5c63478b6045b99421a35afecb

Analysis

max time kernel
142s
max time network
147s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

amateur.dll
Size

1.0MB
MD5

63f8c02fa87e750af09aad4f48b1aa4b
SHA1

f6554c45d574e960ed5f262779ff5aaeb928384e
SHA256

9a149522394b1718586436d43d72a9c9fece1f5c63478b6045b99421a35afecb
SHA512

017adaaf9791fd90906f2f0f7e713bd0ed48075cc2838247d730ef9411a0089f98fc6ad33d0813367dff486bb27e4a5fe4c8123f887f36deddd0f3f986a235e0
SSDEEP

24576:dTOm8Acqmr0tSEud7LgCgF1ZlPluqzGfGhu7h:dzcZotSwCgHEqzG+4

Score

10^/10

bumblebee 132lg trojan

Malware Config

Extracted

Family

bumblebee

Botnet

132lg

205.185.113.34:443

103.144.139.146:443

23.106.223.222:443

95.168.191.248:443

23.106.223.182:443

146.70.29.237:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 7 IoCs

flow	pid	Process
1	1464	rundll32.exe
3	1464	rundll32.exe
4	1464	rundll32.exe
5	1464	rundll32.exe
8	1464	rundll32.exe
11	1464	rundll32.exe
14	1464	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1464	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\amateur.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:1464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-54-0x0000000001FF0000-0x0000000002151000-memory.dmp

Filesize
1.4MB

Download
memory/1464-55-0x00000000001D0000-0x000000000024F000-memory.dmp

Filesize
508KB

Download