Analysis
-
max time kernel
81s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
22-03-2023 14:48
General
-
Target
9e84ae14e226a5c9a3efd85d1b5df6869aab9245cddb4ae6eb81e943886253d6.dll
-
Size
1.0MB
-
MD5
15fed1d31f4af4928e915b36f4baa88e
-
SHA1
32954f133e1713b18f45576dc3244bff47cc19cd
-
SHA256
9e84ae14e226a5c9a3efd85d1b5df6869aab9245cddb4ae6eb81e943886253d6
-
SHA512
15b19901f11f054db976f682e1fe8c84c4cea37ac36956e49844448649c7b73a86bdd2285881e0955af7c14418a45bb0febcaa5e04189c87f2196673671c51ef
-
SSDEEP
24576:meO5bAblScTMT7qZrP7A/lVXiZb0d9hMwPsmBcm8C:membTc8mZr7A7i90nh7Em1
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
mvtm1703
C2
194.135.33.182:443
205.185.127.176:443
103.175.16.133:443
45.61.187.204:443
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Blocklisted process makes network request 1 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9e84ae14e226a5c9a3efd85d1b5df6869aab9245cddb4ae6eb81e943886253d6.dll,#11⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1420 -s 8642⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 204 -p 1420 -ip 14201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
552KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB