Analysis
- max time kernel
144s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
09/10/2023, 22:51
General
- Target Contract_02_21_Copy#32.exe
- Size 1.4MB
- Sample231009-2syjdaba39
- SHA256 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832
Malware Config
Extracted
-
bumblebee
-
21maca
-
108.62.141.20:443
-
104.168.140.145:443
-
51.68.145.171:443
-
108.62.118.170:443
-
192.119.72.133:443
-
23.108.57.201:443
Signatures
- BumbleBee
BumbleBee is a webshell malware written in C++.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Contract_02_21_Copy#32.exe"C:\Users\Admin\AppData\Local\Temp\Contract_02_21_Copy#32.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3044-0-0x000001C1DBD20000-0x000001C1DBDAB000-memory.dmp
memory/3044-2-0x000001C1DBF10000-0x000001C1DC071000-memory.dmp
memory/3044-3-0x00007FFA72590000-0x00007FFA72785000-memory.dmp
memory/3044-1-0x00007FFA72590000-0x00007FFA72785000-memory.dmp
memory/3044-4-0x00007FFA72590000-0x00007FFA72785000-memory.dmp
memory/3044-5-0x00007FFA72590000-0x00007FFA72785000-memory.dmp
memory/3044-7-0x00007FFA72590000-0x00007FFA72785000-memory.dmp
memory/3044-6-0x00007FFA72590000-0x00007FFA72785000-memory.dmp
memory/3044-8-0x000001C1DBF10000-0x000001C1DC071000-memory.dmp
memory/3044-9-0x00007FFA72590000-0x00007FFA72785000-memory.dmp
memory/3044-10-0x00007FFA72590000-0x00007FFA72785000-memory.dmp
memory/3044-11-0x000001C1DBF10000-0x000001C1DC071000-memory.dmp
memory/3044-12-0x00007FFA72590000-0x00007FFA72785000-memory.dmp
memory/3044-13-0x000001C1DBD20000-0x000001C1DBDAB000-memory.dmp