Resubmissions
08-02-2024 21:52
240208-1q8e5ada57 10Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
submitted
08-02-2024 21:52
General
-
Target
ps1.ps1
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
dcc3
Attributes
-
dga
kxk0fp99.life
9b7t2l0q.life
hyivgigf.life
ge0gmguu.life
c0g886v7.life
z5gt6avq.life
bhqjgnyg.life
vtq4vrd1.life
wmds946t.life
lawsc41o.life
8zxvhrw3.life
6t152qng.life
8jenv5cj.life
nnc9xesb.life
vevijml2.life
qblg0klz.life
3botypuk.life
quw31ted.life
n9t609lu.life
mtu5eery.life
guycev3v.life
klcmu5e3.life
hm2psb94.life
wiof5kps.life
ink7i9yf.life
rj3h9lji.life
n0ohhx48.life
d5lspsc8.life
wuxe83rt.life
rka4u64f.life
-
dga_seed
3169630490570045124
-
domain_length
8
-
num_dga_domains
100
-
port
443
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a loader malware written in C++.
-
Bumblebee family
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps1.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" w_ver.dll DllRegisterServer2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
924KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
2.1MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
2.1MB
-
Filesize
924KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB