bumblebee | c181c20d4efe8312d3d6a4de770febe8f48c92e78a4f7dfa7d011bba58ad8b67

Analysis

max time kernel
140s
max time network
152s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-02-2023 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

network.dll
Size

1.0MB
MD5

fb98aec6e04559be2d5ff6e1b7dc5260
SHA1

b83066ae84db1df91ede9fc323ca696085f378f2
SHA256

c181c20d4efe8312d3d6a4de770febe8f48c92e78a4f7dfa7d011bba58ad8b67
SHA512

17dd94fd6f4fc9d1f3444c54516ce5daca5f2ecd306222270fcab01a1abc9e01247732dce9b3afdd813491d3b0f969cad2cbb080cc02eb09f025e9de48186a5c
SSDEEP

24576:ZgqqFfeeOby7LSjsfIMLkC8Jsc0Q+8VC7skZ:NqFVLIsActoC

Score

10^/10

bumblebee 132lg trojan

Malware Config

Extracted

Family

bumblebee

Botnet

132lg

205.185.113.34:443

103.144.139.146:443

23.106.223.222:443

95.168.191.248:443

23.106.223.182:443

146.70.29.237:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 7 IoCs

flow	pid	Process
1	2044	rundll32.exe
2	2044	rundll32.exe
4	2044	rundll32.exe
7	2044	rundll32.exe
10	2044	rundll32.exe
13	2044	rundll32.exe
16	2044	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2044	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\network.dll,#1
1⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-54-0x0000000001F80000-0x00000000020E1000-memory.dmp

Filesize
1.4MB

Download
memory/2044-55-0x0000000001DA0000-0x0000000001E1F000-memory.dmp

Filesize
508KB

Download