Overview

overview

10

Static

static

3

e1.dll

windows7-x64

10

e1.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    129s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    21-06-2023 12:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e1.dll

  • Size

    2.5MB

  • MD5

    04889da884690bd296877a6a2453a715

  • SHA1

    235a8e9a16a4e963fb2c453cbb469ea3e1590da3

  • SHA256

    d1270e29d9a235bb456db76f5c88042eb06964145dd2b31f2ef87d5af1254e57

  • SHA512

    74875267c6b96ef6c44ac19021f96213cd115061f881b22d849ebc98aa21c92af64f46c86b908b2da53d3f6fe8d9e7bd291ce11882cff0d11bf1294a39c58cc2

  • SSDEEP

    49152:Z0wKKSxGGChwZr059ETh7eT4lPo39vRa0Kx6TGpJah:Z0AuYwpOW7Y4lPora0NMa

Score
10/10
bumblebeemsi11606trojan

Malware Config

Extracted

Family

bumblebee

Botnet

msi11606

C2

176.111.174.67:443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

    trojanbumblebee
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\e1.dll
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    PID:844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/844-54-0x0000000001F80000-0x00000000020E1000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/844-56-0x0000000001F80000-0x00000000020E1000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/844-57-0x0000000001F80000-0x00000000020E1000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/844-58-0x0000000001E10000-0x0000000001F76000-memory.dmp

    Filesize

    1.4MB

    Download

  • memory/844-59-0x0000000001F80000-0x00000000020E1000-memory.dmp

    Filesize

    1.4MB

    Download