Analysis
-
max time kernel
131s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
09-10-2023 22:23
General
-
Target
LdrAddX64_out_cr70.dll
-
Size
894KB
-
MD5
a4e4f8966796845079ca6b853fd1899d
-
SHA1
25906943d58610a2208c9312c555dee7eb16952e
-
SHA256
15b7cb2818530bbf0b55ea608d85df1bd97004a8556a358c11f84dbb93b893f7
-
SHA512
22df60f5d457cca829aa86f708d6df492aa8acf794dbaed5bfac06b3f6fcbd7a331139c92465a9e5ec57232b76102b26ba593e527266709fd225ca15a3c3045a
-
SSDEEP
12288:1hPALJCb+JI7GB5ShQUO3wY6Wpg8qvtN2FCOWPZzMe0n28qX2Y5aIv/86PaeAkYT:1hum+JI/jO3z6WStlFq4Gd66PybS
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
lg1010
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\LdrAddX64_out_cr70.dll1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444KB
-
Filesize
1.0MB
-
Filesize
1.7MB
-
Filesize
1.0MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.0MB
-
Filesize
444KB
-
Filesize
1.7MB