Overview

overview

10

Static

static

1

inst1.exe

windows7-x64

10

inst1.exe

windows10-1703-x64

10

Resubmissions

16/10/2023, 02:56

231016-de79nadd7510

09/10/2023, 22:51

231009-2szfnsba4310

05/04/2023, 07:15

230405-h3fxjacc8510

Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-de
  • resource tags

    arch:x64arch:x86image:win10-20230220-delocale:de-deos:windows10-1703-x64systemwindows
  • submitted
    05/04/2023, 07:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    inst1.exe
  • Size 1.6MB
  • Sample230405-h3fxjacc85
  • SHA256 35f2ec59313bbe5b78e4b043f06f8961f6f3e77b870544d15ee7cc1fca987d8c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
bumblebeeinsttrojan

Malware Config

Extracted

Family

  • bumblebee

Botnet

  • inst

C2

  • 194.15.216.247:443

  • 23.106.215.141:443

  • 104.168.244.96:443

  • 51.83.255.85:443

  • 192.119.81.86:443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\inst1.exe
    "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    PID:324

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/324-121-0x000002ADB9C80000-0x000002ADB9DE1000-memory.dmp
        Download

        memory/324-122-0x000002ADB9C80000-0x000002ADB9DE1000-memory.dmp
        Download

        memory/324-123-0x000002ADB9C80000-0x000002ADB9DE1000-memory.dmp
        Download

        memory/324-124-0x000002ADB9A80000-0x000002ADB9B12000-memory.dmp
        Download