Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
18-03-2023 01:35
General
-
Target
Documents invoice-plan_032023D.exe
-
Size
1.5MB
-
MD5
f7a10eb821d8240c575b688d837ae937
-
SHA1
c58d0c8ed6f9120ec68d9f39ba72c487583b5aef
-
SHA256
292a354782e33a4cec2fbe5e24d3d464d7978d7f676f50b4a28c86a722a99a5f
-
SHA512
2eb2d1c451124567be49cf24fcb80eabf0cd344f74decc73e773bb4ec0832916d16e6a809b3ca88759509585458b02cb8b44ecde0cbfb909eab83a2990c11751
-
SSDEEP
24576:llitobyFBDzaedo/ngn0W8pHa7YpmxCvWB9ImnxDgB:llitoGBaZCqMYpmx+WBWIxDO
Malware Config
Extracted
bumblebee
lg1703
37.28.155.36:443
192.254.79.101:443
107.189.12.129:443
51.83.248.92:443
194.135.33.184:443
194.135.33.85:443
103.175.16.104:443
205.185.113.34:443
172.86.120.111:443
192.111.146.184:443
209.141.53.174:443
195.133.192.10:443
51.68.144.43:443
157.254.194.119:443
146.19.173.86:443
209.141.40.19:443
160.20.147.242:443
104.168.157.253:443
103.175.16.15:443
51.75.62.204:443
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Documents invoice-plan_032023D.exe"C:\Users\Admin\AppData\Local\Temp\Documents invoice-plan_032023D.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
596KB
-
Filesize
1.4MB