Analysis
-
max time kernel
128s -
max time network
132s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
-
submitted
14-09-2023 08:45
General
-
Target
e1dbce8a89b5fea0f3cf6da9560fd573dfe9c93c5d6d8d2fef8902a3589cdf15.dll
-
Size
1.1MB
-
MD5
a6ac1a8bb63362ed7515f2ca02fb52be
-
SHA1
8781347d2e723f823d5b996bc22389b14a4a72c8
-
SHA256
e1dbce8a89b5fea0f3cf6da9560fd573dfe9c93c5d6d8d2fef8902a3589cdf15
-
SHA512
6f01f0a630afff0dd71c5e457c8dbdb3a7743fb6337740384e034dad0d6b3f002992f2df5c953f223f8b2589098c43640b705a25482ed1c939a61b6dd783392d
-
SSDEEP
24576:K40kaG+iDe5cMQW7v7+KIUC/ofj1fpLgN:K40kd+35cMv
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
js1
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Program crash 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\e1dbce8a89b5fea0f3cf6da9560fd573dfe9c93c5d6d8d2fef8902a3589cdf15.dll1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 392 -s 4482⤵
- Program crash
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
-
Filesize
1.0MB
-
Filesize
1.9MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
484KB
-
Filesize
1.9MB