Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
15-09-2023 12:28
General
-
Target
131cee43a6f14bd9133246e87828275c30b2ad9d3036b4fcd4a08001903fa7e7_JC.dll
-
Size
1.1MB
-
MD5
3a96a42f6d6334a36d2ea26abb0a2c95
-
SHA1
d88496edc6ed76072d656f68c3bd845bc823e442
-
SHA256
131cee43a6f14bd9133246e87828275c30b2ad9d3036b4fcd4a08001903fa7e7
-
SHA512
1dc98be046c80e65e028fac53340e90397c0aca7fdb33b9fa22f7e9ca2e6947b86170d0660fd2a391569959661b3e4634a925a16f4d2a4edcd4beb0dfa302ca1
-
SSDEEP
12288:VOQRLO3Bp/U4uxkfRZ2qKoWep2F0D02lHoSrcrb+OArPFJz9N4xvYb8:VOQR63XMxkpkqKZ+e0Z8uprPrf4xQo
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
js1
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\131cee43a6f14bd9133246e87828275c30b2ad9d3036b4fcd4a08001903fa7e7_JC.dll1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
-
Filesize
1.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.0MB
-
Filesize
484KB
-
Filesize
2.0MB