Analysis
- max time kernel
315s - platform
windows10-1703_x64 - resource
win10-20231215-en - submitted
17/01/2024, 08:56
General
- Target af5af36999fcc71cf7e93bbe64bb6299509dde3e40c5b78978ee3cd5b5ddda7d.dll
- Size 2.1MB
- Sample240117-kwdvpschf8
- SHA256 af5af36999fcc71cf7e93bbe64bb6299509dde3e40c5b78978ee3cd5b5ddda7d
Malware Config
Extracted
-
bumblebee
-
f1
-
dga
n64c2akw.life
zefawfb0.life
dph3pby8.life
hx0hysyg.life
1qa3k743.life
luw8ubf2.life
rbvsf6io.life
4huoqrsp.life
8qwcvseh.life
37zi55wc.life
i9f44mju.life
aqnx9c9h.life
3nmeg5wa.life
r5ue5rok.life
et53yjoc.life
tvgco82h.life
0xtmu3tz.life
6xhpschv.life
6o26tws0.life
0oz7923s.life
54y2q50j.life
9hh7hq5r.life
r0ca080m.life
43vtghfz.life
qal55els.life
p5e68m36.life
x698iah6.life
kqn0zkig.life
wq6w8jkq.life
i6n08gx7.life
-
dga_seed_string
anjd78ka
-
domain_length
8
-
num_dga_domains
100
-
port
443
Signatures
- BumbleBee
BumbleBee is a loader malware written in C++.
- Bumblebee family
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\af5af36999fcc71cf7e93bbe64bb6299509dde3e40c5b78978ee3cd5b5ddda7d.dll1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2980-0-0x0000000002640000-0x0000000002727000-memory.dmp
memory/2980-2-0x00000000029E0000-0x0000000002BF8000-memory.dmp
memory/2980-4-0x00007FFBA2A20000-0x00007FFBA2BFB000-memory.dmp
memory/2980-3-0x00000000029E0000-0x0000000002BF8000-memory.dmp
memory/2980-1-0x00007FFBA2A20000-0x00007FFBA2BFB000-memory.dmp
memory/2980-6-0x00000000029E0000-0x0000000002BF8000-memory.dmp
memory/2980-5-0x00007FFBA2A20000-0x00007FFBA2BFB000-memory.dmp
memory/2980-8-0x00007FFBA2A20000-0x00007FFBA2BFB000-memory.dmp
memory/2980-7-0x00007FFBA2A20000-0x00007FFBA2BFB000-memory.dmp
memory/2980-9-0x0000000002640000-0x0000000002727000-memory.dmp