Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
14-10-2023 01:40
General
-
Target
oyylqpp3ia.dll
-
Size
1.1MB
-
MD5
45f4c6ea59bc7a8c2d20098698104940
-
SHA1
08b4a0c8d7824a0dbd89680a70f3029355cfafea
-
SHA256
2aae03be2893a2d742528bbd737b4195d84f6d3663e9eeff8c646c53675d7838
-
SHA512
ae705022b4599ac0a551df96b9acda5542ef42b331c0cd89e87a71ae6c9e8919e3e2a8368857ba88bca7efb5d3150056f0c335eaaa7472cd8cc7202ecc2fd475
-
SSDEEP
12288:yh/mUxV9yUJLB9hbJGk01nVJT24GUhKnsHwuDVPVIzI2mxFfokvqRLKAV55PH:yh/nBB9hSZGAwysoxFfooqRLb55P
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
js1
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a webshell malware written in C++.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\oyylqpp3ia.dll1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
-
Filesize
1.7MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.7MB
-
Filesize
1.0MB
-
Filesize
484KB
-
Filesize
1.7MB