Resubmissions
08-02-2024 21:52
240208-1q8e5ada57 10Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
submitted
08-02-2024 21:52
General
-
Target
ps1.ps1
Malware Config
Extracted
bumblebee
dcc3
-
dga
kxk0fp99.life
9b7t2l0q.life
hyivgigf.life
ge0gmguu.life
c0g886v7.life
z5gt6avq.life
bhqjgnyg.life
vtq4vrd1.life
wmds946t.life
lawsc41o.life
8zxvhrw3.life
6t152qng.life
8jenv5cj.life
nnc9xesb.life
vevijml2.life
qblg0klz.life
3botypuk.life
quw31ted.life
n9t609lu.life
mtu5eery.life
guycev3v.life
klcmu5e3.life
hm2psb94.life
wiof5kps.life
ink7i9yf.life
rj3h9lji.life
n0ohhx48.life
d5lspsc8.life
wuxe83rt.life
rka4u64f.life
-
dga_seed
3169630490570045124
-
domain_length
8
-
num_dga_domains
100
-
port
443
Signatures
-
BumbleBee
BumbleBee is a loader malware written in C++.
-
Bumblebee family
-
Blocklisted process makes network request 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps1.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" w_ver.dll DllRegisterServer2⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
924KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
924KB
-
Filesize
2.0MB