bumblebee | 9a149522394b1718586436d43d72a9c9fece1f5c63478b6045b99421a35afecb

Analysis

max time kernel
135s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
15-02-2023 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

amateur.dll
Size

1.0MB
MD5

63f8c02fa87e750af09aad4f48b1aa4b
SHA1

f6554c45d574e960ed5f262779ff5aaeb928384e
SHA256

9a149522394b1718586436d43d72a9c9fece1f5c63478b6045b99421a35afecb
SHA512

017adaaf9791fd90906f2f0f7e713bd0ed48075cc2838247d730ef9411a0089f98fc6ad33d0813367dff486bb27e4a5fe4c8123f887f36deddd0f3f986a235e0
SSDEEP

24576:dTOm8Acqmr0tSEud7LgCgF1ZlPluqzGfGhu7h:dzcZotSwCgHEqzG+4

Score

10^/10

bumblebee 132lg trojan

Malware Config

Extracted

Family

bumblebee

Botnet

132lg

205.185.113.34:443

103.144.139.146:443

23.106.223.222:443

95.168.191.248:443

23.106.223.182:443

146.70.29.237:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 7 IoCs

flow	pid	Process
12	4460	rundll32.exe
23	4460	rundll32.exe
33	4460	rundll32.exe
40	4460	rundll32.exe
43	4460	rundll32.exe
45	4460	rundll32.exe
46	4460	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4460	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\amateur.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4460-132-0x0000021C91630000-0x0000021C91791000-memory.dmp

Filesize
1.4MB

Download
memory/4460-133-0x0000021C912F0000-0x0000021C9136F000-memory.dmp

Filesize
508KB

Download