Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
13-09-2023 16:14
General
-
Target
5hzkjlg864.dll
-
Size
1.1MB
-
MD5
946ff48f5b0f50a5501979347e8a411f
-
SHA1
407e18f76b337fe146b100c2a330ab7b5844c6ed
-
SHA256
35105efb993284937212530ebf3625f532dfb9b00b73409c266ad380d0665b4f
-
SHA512
d06328b0c92cd6237758d27060ab8a2b9b230454f194bb434c39945a5670b6ea8505109a6c3ea739758c5f26c0dbc400d1e1620695d812d687bd25fce54eba8e
-
SSDEEP
24576:bQAzTZH7ALVi4S8lvHV40phqqOCx/ZDAwPM:1zTZHE5rt9
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
js1
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5hzkjlg864.dll1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
-
Filesize
1.7MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.0MB
-
Filesize
484KB
-
Filesize
1.7MB