Overview

overview

10

Static

static

3

ps1.ps1

windows7-x64

10

ps1.ps1

windows10-2004-x64

10

w_ver.dll

windows7-x64

10

w_ver.dll

windows10-2004-x64

10

Resubmissions

08-02-2024 21:52

240208-1q8e5ada57 10

Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • submitted
    08-02-2024 21:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    w_ver.dll

Score
10/10
bumblebeedcc3loader

Malware Config

Extracted

Family

bumblebee

Botnet

dcc3

Attributes
  • dga

    kxk0fp99.life

    9b7t2l0q.life

    hyivgigf.life

    ge0gmguu.life

    c0g886v7.life

    z5gt6avq.life

    bhqjgnyg.life

    vtq4vrd1.life

    wmds946t.life

    lawsc41o.life

    8zxvhrw3.life

    6t152qng.life

    8jenv5cj.life

    nnc9xesb.life

    vevijml2.life

    qblg0klz.life

    3botypuk.life

    quw31ted.life

    n9t609lu.life

    mtu5eery.life

    guycev3v.life

    klcmu5e3.life

    hm2psb94.life

    wiof5kps.life

    ink7i9yf.life

    rj3h9lji.life

    n0ohhx48.life

    d5lspsc8.life

    wuxe83rt.life

    rka4u64f.life

  • dga_seed

    3169630490570045124

  • domain_length

    8

  • num_dga_domains

    100

  • port

    443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Bumblebee family
    bumblebee
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\w_ver.dll
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    PID:2436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2436-0-0x0000000001E00000-0x0000000001EE7000-memory.dmp

    Filesize

    924KB

    Download

  • memory/2436-1-0x00000000771A0000-0x0000000077349000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2436-3-0x00000000771A0000-0x0000000077349000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2436-2-0x0000000002190000-0x00000000023A8000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2436-6-0x0000000002190000-0x00000000023A8000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2436-5-0x00000000771A0000-0x0000000077349000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2436-7-0x0000000002190000-0x00000000023A8000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2436-8-0x0000000001E00000-0x0000000001EE7000-memory.dmp

    Filesize

    924KB

    Download

  • memory/2436-9-0x00000000771A0000-0x0000000077349000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2436-10-0x00000000771A0000-0x0000000077349000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2436-11-0x00000000771A0000-0x0000000077349000-memory.dmp

    Filesize

    1.7MB

    Download