Analysis
- max time kernel
148s - max time network
157s - platform
windows7_x64 - resource
win7-20230831-en - resource tags
- submitted
09/10/2023, 22:51
General
- Target Contract_02_21_Copy#32.exe
- Size 1.4MB
- Sample231009-2syjdaba39
- SHA256 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832
Score
10/10
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
21maca
C2
-
108.62.141.20:443
-
104.168.140.145:443
-
51.68.145.171:443
-
108.62.118.170:443
-
192.119.72.133:443
-
23.108.57.201:443
rc4.plain
Signatures
- BumbleBee
BumbleBee is a webshell malware written in C++.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Contract_02_21_Copy#32.exe"C:\Users\Admin\AppData\Local\Temp\Contract_02_21_Copy#32.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1052-0-0x00000000000D0000-0x000000000015B000-memory.dmp
memory/1052-1-0x0000000077840000-0x00000000779E9000-memory.dmp
memory/1052-2-0x00000000005F0000-0x0000000000751000-memory.dmp
memory/1052-3-0x0000000077840000-0x00000000779E9000-memory.dmp
memory/1052-4-0x00000000005F0000-0x0000000000751000-memory.dmp
memory/1052-5-0x00000000005F0000-0x0000000000751000-memory.dmp
memory/1052-6-0x00000000000D0000-0x000000000015B000-memory.dmp
memory/1052-7-0x0000000077840000-0x00000000779E9000-memory.dmp