Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    15-09-2023 12:39

General

  • Target

    452bb497728f1eb2ccd56b83f7a13e51447bd79852085e68908cb6c47625060b_JC.dll

  • Size

    1.1MB

  • MD5

    7d2156efddf126dfb4c466da06f15e11

  • SHA1

    cf90131f73f72b7f32bccca438283a04a1001dbe

  • SHA256

    452bb497728f1eb2ccd56b83f7a13e51447bd79852085e68908cb6c47625060b

  • SHA512

    83496c49175e85e627ff320ec954f1e393d1473e17bf098f3dfbb98c09b18da6c1d4258bdcfcecc382a8da91424ff63ad882deb8a9572fecb6c667b131d74fe4

  • SSDEEP

    24576:drD2uxNbJd3BU7XFLH9io8hAGOAHxLrQ+P3U:ZDBxNvR

Score
10/10

Malware Config

Extracted

Family

bumblebee

Botnet

js1

rc4.plain
1
NEW_BLACK

Signatures

  • BumbleBee

    BumbleBee is a webshell malware written in C++.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\452bb497728f1eb2ccd56b83f7a13e51447bd79852085e68908cb6c47625060b_JC.dll
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    PID:2124

Network

  • flag-us
    DNS
    v5b6ml4o0nq.life
    regsvr32.exe
    Remote address:
    8.8.8.8:53
    Request
    v5b6ml4o0nq.life
    IN A
    Response
    v5b6ml4o0nq.life
    IN A
    116.203.151.240
  • 116.203.151.240:443
    v5b6ml4o0nq.life
    https
    regsvr32.exe
    1.1kB
    906 B
    12
    14
  • 116.203.151.240:443
    v5b6ml4o0nq.life
    https
    regsvr32.exe
    1.1kB
    906 B
    12
    14
  • 116.203.151.240:443
    v5b6ml4o0nq.life
    https
    regsvr32.exe
    1.1kB
    906 B
    12
    14
  • 8.8.8.8:53
    v5b6ml4o0nq.life
    dns
    regsvr32.exe
    62 B
    78 B
    1
    1

    DNS Request

    v5b6ml4o0nq.life

    DNS Response

    116.203.151.240

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2124-0-0x0000000000120000-0x0000000000199000-memory.dmp

    Filesize

    484KB

  • memory/2124-1-0x0000000077970000-0x0000000077B19000-memory.dmp

    Filesize

    1.7MB

  • memory/2124-2-0x0000000002040000-0x000000000214A000-memory.dmp

    Filesize

    1.0MB

  • memory/2124-4-0x0000000002040000-0x000000000214A000-memory.dmp

    Filesize

    1.0MB

  • memory/2124-5-0x0000000077970000-0x0000000077B19000-memory.dmp

    Filesize

    1.7MB

  • memory/2124-6-0x0000000002040000-0x000000000214A000-memory.dmp

    Filesize

    1.0MB

  • memory/2124-7-0x0000000000120000-0x0000000000199000-memory.dmp

    Filesize

    484KB

  • memory/2124-8-0x0000000077970000-0x0000000077B19000-memory.dmp

    Filesize

    1.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.