bumblebee | 7a33dd7271575d93a84138ff4d6ebe4eb068ee83555cade505eb6c84d4a5f302

Resubmissions

08-02-2024 21:52

240208-1q8e5ada57 10

Analysis

max time kernel
146s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
08-02-2024 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ps1.ps1
Size

71B
MD5

e6fb5ed0cbd3e324d774c7c8ff2c6caa
SHA1

fe7769b3632dec7700d4a81d44609095d0e56a98
SHA256

1e65ebca25cee22de96f313bf810a7f3324f3e811bbc1f0636aa9fdbc3801138
SHA512

f511c21615fd7ce18c5d1108d6c42f7e645ccb0db104721ec323a5e418eb8f7ef80c3a11c1d5e671269642f214daca6b720d64d54109d51549f7e0c42f2a827c

Score

10^/10

bumblebee dcc3 loader

Malware Config

Extracted

Family

bumblebee

Botnet

dcc3

Attributes

dga
vg7uaic3.life

9rzeyw6d.life

gaiuzmjh.life

fjtwh7ez.life

b7v0h14g.life

25utqefr.life

racgyvid.life

hocj7ez7.life

0yznun55.life

fcl2tw80.life

g4ggjukx.life

u3zvhegy.life

n6s0rru2.life

myskwtvz.life

es4xrlbf.life

rm0vgyz1.life

mkt3shgr.life

uj1lqdzb.life

wdxn08y6.life

xwcetuq6.life

7v3pqzur.life

z4u0pw7m.life

akzuglxg.life

0hb72lv4.life

qo725zwl.life

h5hyssny.life

dwdgv8ey.life

r1vp426o.life

s68s3bdd.life

r4x6iy6x.life

accq42df.life

z15hvoz2.life

idqrdhpg.life

sx3i8jmk.life

g7on0c47.life

d0paetq1.life

jtyk5gdq.life

wiw2pzow.life

f94vimcc.life

ztlkhvae.life

2m420uuq.life

18nf94hr.life

mc255438.life

4qrr6ij0.life

ql5hk4dj.life

b0wknuvv.life

c8o1xb3q.life

x1268u29.life

22km13qy.life

fjtg4l8d.life

12jawwzi.life

bnevdx61.life

fmeojv6b.life

frm6u0r1.life

acuaw2q0.life

i8kyugpr.life

zo2epezl.life

y7px5b06.life

x3h1ahco.life

y3v1d1vu.life

tmzcoebw.life

t5me2n7i.life

u45wcqn7.life

thde5hd5.life

56snpngr.life

orc3zq3c.life

ecdb0x3j.life

1330r5tl.life

ymxcwnjs.life

4eo14u97.life

dza0z859.life

gvwgb5nw.life

0be6z82a.life

qz0pzkv1.life

ig4xohtj.life

rtnzmwv0.life

x9e2x6a2.life

wvxatase.life

5zime47c.life

o0r9qsit.life

x2h84q1y.life

5s9j4ij0.life

rqmbst2l.life

widcqm70.life

kkrmo7k8.life

lni114wn.life

w9inw8u1.life

qpxq51gq.life

2r5pct64.life

2x5sidtj.life

61oankru.life

n1iq0gkh.life

g27j5iqe.life

y0a5tf81.life

pmrzi1bx.life

7nx3ips8.life

5a0mrc70.life

5cai9tan.life

4bekj09u.life

2jrlu58d.life
dga_seed
Ķ�C#��+
domain_length
8
num_dga_domains
100
port
443

rc4.plain

Signatures

BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

rundll32.exe

pid process

2768 rundll32.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

1940 powershell.exe
1940 powershell.exe
1940 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1940 powershell.exe

pid	process
2768	rundll32.exe

pid	process
1940	powershell.exe
1940	powershell.exe
1940	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1940	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1940 wrote to memory of 2768	1940	powershell.exe	rundll32.exe
PID 1940 wrote to memory of 2768	1940	powershell.exe	rundll32.exe
PID 1940 wrote to memory of 2768	1940	powershell.exe	rundll32.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps1.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" w_ver.dll DllRegisterServer
2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:2768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-4-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/1940-5-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download
memory/1940-6-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Filesize
9.6MB

Download
memory/1940-7-0x0000000002B80000-0x0000000002C00000-memory.dmp

Filesize
512KB

Download
memory/1940-8-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Filesize
9.6MB

Download
memory/1940-9-0x0000000002B80000-0x0000000002C00000-memory.dmp

Filesize
512KB

Download
memory/1940-10-0x0000000002B80000-0x0000000002C00000-memory.dmp

Filesize
512KB

Download
memory/1940-11-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Filesize
9.6MB

Download
memory/2768-12-0x0000000001FB0000-0x0000000002097000-memory.dmp

Filesize
924KB

Download
memory/2768-13-0x0000000077670000-0x0000000077819000-memory.dmp

Filesize
1.7MB

Download
memory/2768-15-0x0000000077670000-0x0000000077819000-memory.dmp

Filesize
1.7MB

Download
memory/2768-14-0x00000000022C0000-0x00000000024D8000-memory.dmp

Filesize
2.1MB

Download
memory/2768-16-0x0000000077670000-0x0000000077819000-memory.dmp

Filesize
1.7MB

Download
memory/2768-18-0x0000000077670000-0x0000000077819000-memory.dmp

Filesize
1.7MB

Download
memory/2768-19-0x0000000077670000-0x0000000077819000-memory.dmp

Filesize
1.7MB

Download
memory/2768-17-0x0000000077670000-0x0000000077819000-memory.dmp

Filesize
1.7MB

Download
memory/2768-20-0x00000000022C0000-0x00000000024D8000-memory.dmp

Filesize
2.1MB

Download
memory/2768-21-0x0000000001FB0000-0x0000000002097000-memory.dmp

Filesize
924KB

Download
memory/2768-22-0x0000000077670000-0x0000000077819000-memory.dmp

Filesize
1.7MB

Download
memory/2768-23-0x0000000077670000-0x0000000077819000-memory.dmp

Filesize
1.7MB

Download
memory/2768-24-0x0000000077670000-0x0000000077819000-memory.dmp

Filesize
1.7MB

Download