Resubmissions
08-02-2024 21:52
240208-1q8e5ada57 10Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
08-02-2024 21:52
General
-
Target
ps1.ps1
-
Size
71B
-
MD5
e6fb5ed0cbd3e324d774c7c8ff2c6caa
-
SHA1
fe7769b3632dec7700d4a81d44609095d0e56a98
-
SHA256
1e65ebca25cee22de96f313bf810a7f3324f3e811bbc1f0636aa9fdbc3801138
-
SHA512
f511c21615fd7ce18c5d1108d6c42f7e645ccb0db104721ec323a5e418eb8f7ef80c3a11c1d5e671269642f214daca6b720d64d54109d51549f7e0c42f2a827c
Malware Config
Extracted
bumblebee
dcc3
-
dga
vg7uaic3.life
9rzeyw6d.life
gaiuzmjh.life
fjtwh7ez.life
b7v0h14g.life
25utqefr.life
racgyvid.life
hocj7ez7.life
0yznun55.life
fcl2tw80.life
g4ggjukx.life
u3zvhegy.life
n6s0rru2.life
myskwtvz.life
es4xrlbf.life
rm0vgyz1.life
mkt3shgr.life
uj1lqdzb.life
wdxn08y6.life
xwcetuq6.life
7v3pqzur.life
z4u0pw7m.life
akzuglxg.life
0hb72lv4.life
qo725zwl.life
h5hyssny.life
dwdgv8ey.life
r1vp426o.life
s68s3bdd.life
r4x6iy6x.life
-
dga_seed
Ķ�C#��+
-
domain_length
8
-
num_dga_domains
100
-
port
443
Signatures
-
BumbleBee
BumbleBee is a loader malware written in C++.
-
Blocklisted process makes network request 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps1.ps11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" w_ver.dll DllRegisterServer2⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
924KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
924KB
-
Filesize
2.0MB