Analysis
- max time kernel
136s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
14/10/2023, 01:36
General
- Target b8fc2474a801ea4b51df01d869c192cf430d72763758d8ca68cc43e318fdc7a0.dll
- Size 1.1MB
- Sample231014-bz9bcaaa7t
- SHA256 b8fc2474a801ea4b51df01d869c192cf430d72763758d8ca68cc43e318fdc7a0
Score
10/10
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
js1
rc4.plain
Signatures
- BumbleBee
BumbleBee is a webshell malware written in C++.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\b8fc2474a801ea4b51df01d869c192cf430d72763758d8ca68cc43e318fdc7a0.dll1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5032-0-0x00000000021C0000-0x0000000002239000-memory.dmp
memory/5032-1-0x00007FFF112B0000-0x00007FFF114A5000-memory.dmp
memory/5032-2-0x0000000002350000-0x000000000245A000-memory.dmp
memory/5032-4-0x00007FFF112B0000-0x00007FFF114A5000-memory.dmp
memory/5032-3-0x0000000002350000-0x000000000245A000-memory.dmp
memory/5032-5-0x0000000002350000-0x000000000245A000-memory.dmp
memory/5032-6-0x0000000002350000-0x000000000245A000-memory.dmp
memory/5032-7-0x00000000021C0000-0x0000000002239000-memory.dmp
memory/5032-8-0x00007FFF112B0000-0x00007FFF114A5000-memory.dmp