bumblebee | 7751a09b3c1146b5db72be1218287da6fd4c65813a1eb9ae5e0389db879daaeb | Triage

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15-02-2023 19:25

Sharing

Report Analysis Logs

General

Target

payload.dll
Size

1.4MB
MD5

12a99f8ae458862da2eddfb661ae7ced
SHA1

f5f31414a29dac9e35888cd48a980d702f99fe70
SHA256

7751a09b3c1146b5db72be1218287da6fd4c65813a1eb9ae5e0389db879daaeb
SHA512

660032ffdb21aebda0ac30d363b198dab70187c3848c3e9c727f02b00e5ecd351bc85e1bd5b2fb4d568a90c2ce5ad2a058e20b42d0aaff4b12bcb46cfee58526
SSDEEP

24576:g1GayIeFrnKgVGPCXr++xDTku+h5UZasJ2QfeFDXTZ9DztMa:ZQgVsCXfgu+h5UFpGFDN9D6a

Score

10^/10

bumblebee hsyishsmqu trojan

Malware Config

Extracted

Family

bumblebee

Botnet

HsyIsHsmQu

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1736	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\payload.dll,#1
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:1736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-54-0x0000000001B60000-0x0000000001CD5000-memory.dmp

Filesize
1.5MB

Download