Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-02-2023 15:24

General

  • Target

    SCAN_0217_1782178.exe

  • Size

    709.9MB

  • MD5

    dbfa17c6178f529a9fa53e8abbdf581f

  • SHA1

    15ca1f14c976b21d13e778579ee4bda85bcce38e

  • SHA256

    5f53faea707f92064542729e0e94a21df59aad7aa1c67ba212048f2ee9278c44

  • SHA512

    c04ea42da88c434da3cd5eb0d4fda26c4803f257ffb2acb57d36f08e679372aa7170ae360fb63777e1526acb2df37fec6a6fa94c27e110a91dcccfa84a0c4161

  • SSDEEP

    24576:KB1W0u8Tl/0SljPppnC6zzdyRUh9yXOVYgCoHI:S8kTT668VOXBo

Score
10/10

Malware Config

Extracted

Family

bumblebee

Botnet

17maca

C2

108.62.141.20:443

23.108.57.201:443

108.62.118.170:443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SCAN_0217_1782178.exe
    "C:\Users\Admin\AppData\Local\Temp\SCAN_0217_1782178.exe"
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    PID:5012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5012-132-0x00007FF731DA0000-0x00007FF732DA0000-memory.dmp

    Filesize

    16.0MB

  • memory/5012-133-0x0000015C26C60000-0x0000015C26DC1000-memory.dmp

    Filesize

    1.4MB

  • memory/5012-134-0x0000015C26A40000-0x0000015C26ACB000-memory.dmp

    Filesize

    556KB

  • memory/5012-135-0x00007FF731DA0000-0x00007FF732DA0000-memory.dmp

    Filesize

    16.0MB