bumblebee | 187754f20558b7d67abb233e84ee14a85ea1791983d87d5a4dfe062799ae3d3c

Resubmissions

21/04/2023, 01:45

230421-b6dg9afd6x 10

20/04/2023, 19:19

230420-x1hexabh38 3

Analysis

max time kernel
137s
max time network
150s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/04/2023, 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3oCGqe4g.UBr.dll
Size

1.4MB
MD5

2f7cc32eab5132846f2c60cd49b11503
SHA1

a3bd016dd1d2f26857594d4d60f36bc73e9ede99
SHA256

187754f20558b7d67abb233e84ee14a85ea1791983d87d5a4dfe062799ae3d3c
SHA512

2ad2ca1341a5603c76ee0137d88b7134aec944333c41b0aca3af3ca3415e65127225c6b1753d11bf0a1d3b570e00fa6ebb95824f09e048d13d45dfae0ef8e433
SSDEEP

24576:o9sBKJRPFHYCRNJYM9WFw7/ekQ6o2LRNtVRIO72f6hPEK3X5Kk:yhzLRQQ

Score

10^/10

bumblebee mc1904 trojan

Malware Config

Extracted

Family

bumblebee

Botnet

mc1904

146.70.155.82:443

149.3.170.179:443

103.175.16.150:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Blocklisted process makes network request 4 IoCs

flow	pid	Process
3	1864	rundll32.exe
4	1864	rundll32.exe
5	1864	rundll32.exe
6	1864	rundll32.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1864	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1864	1588	cmd.exe	32
PID 1588 wrote to memory of 1864	1588	cmd.exe	32
PID 1588 wrote to memory of 1864	1588	cmd.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3oCGqe4g.UBr.dll,#1
1⤵
PID:1248

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,0
1⤵
PID:556

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:908

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\system32\rundll32.exe
  rundll32 3oCGqe4g.UBr.dll,bYXjdERymsFY
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of NtCreateThreadExHideFromDebugger
  PID:1864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1864-54-0x0000000001F30000-0x0000000002091000-memory.dmp

Filesize
1.4MB

Download
memory/1864-55-0x0000000001F30000-0x0000000002091000-memory.dmp

Filesize
1.4MB

Download
memory/1864-56-0x0000000001F30000-0x0000000002091000-memory.dmp

Filesize
1.4MB

Download
memory/1864-57-0x0000000001BC0000-0x0000000001C3A000-memory.dmp

Filesize
488KB

Download