bumblebee | 39e300a5b4278a3ff5fe48c7fa4bd248779b93bbb6ade55e38b22de5f9d64c3c

Resubmissions

09-10-2023 22:51

231009-2sy5xaha2t 10

19-04-2023 21:14

230419-z3esxafd2x 10

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
19-04-2023 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

outout.dll
Size

1.4MB
MD5

e7ee02d4c897e87048232a891e2a97f8
SHA1

36ee65e12cc044d99fd0654d8f4792910b1a3046
SHA256

39e300a5b4278a3ff5fe48c7fa4bd248779b93bbb6ade55e38b22de5f9d64c3c
SHA512

8b1ecdab172e44c61c9b86785da76297f0c3c7eb68755149e9ca14a64ef39c581ee05e39c2fc98861260eaef848b2e542b59f34ef6844d3ef27ef5f758351fa1
SSDEEP

24576:Eo10e/WhcerhA1HqikX3CUDA49JOOx2nP6c5P8hAlm3wKjHsElse:LUxhAxq7TDA4j7q55EhcGjHt

Score

10^/10

bumblebee cis21704 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

cis21704

149.3.170.185:443

192.254.79.106:443

103.175.16.149:443

23.108.57.117:443

209.141.58.129:443

21.253.40.63:443

199.195.249.67:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1240	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\outout.dll,#1
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:1240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1240-54-0x0000000001B50000-0x0000000001CBA000-memory.dmp

Filesize
1.4MB

Download
memory/1240-55-0x00000000779C0000-0x00000000779C1000-memory.dmp

Filesize
4KB

Download