Overview

overview

10

Static

static

3

name.dll

windows10-2004-x64

10

Resubmissions

23-02-2024 09:54

240223-lw8whsfa37 10

18-01-2024 17:02

240118-vj468sedd7 10

17-01-2024 08:56

240117-kv7fmacagr 10

13-09-2023 20:10

230913-yx26ksef8w 10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-02-2024 09:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    name.dll

  • Size

    1.1MB

  • MD5

    ff519023357a9cc5bb731d798de2f6b6

  • SHA1

    c14545a2d261647012a825e77af3a52fbc2cbc4d

  • SHA256

    e714557aa665651045795c747d9b0faec60863c27edd579c7d6ed75bb33b94f1

  • SHA512

    daddc936416b6ff42bdc47ea50b9b7e0acdaa202f46f75e8a14422c5254eb9a23918bd42ea6131503692045cbedf66373429c9c3cd07286c649f2a04801df1c0

  • SSDEEP

    24576:Zf4/h/FsE6r+XMKFo6hFWHWhw7a9LfMtJ3JCI:J4/hNsEiKK

Score
10/10
bumblebeejs1loader

Malware Config

Extracted

Family

bumblebee

Botnet

js1

Attributes
  • dga

    v5b6ml4o0nq.life

    d4mdwvwm8c8.life

    6uwsby1vmyj.life

    mp0zt8ctj70.life

    tkqeai6tead.life

    2xek4jch3xf.life

    ugwfyzhao98.life

    auq2lckl2e0.life

    1odrw6y2sad.life

    hk5ekbl02o8.life

    knqbckw92x9.life

    nnjg4uf5vij.life

    nk4xgtjnvs9.life

    7xbapl162fg.life

    8djp3zmzbif.life

    nojzch0pgfo.life

    b9dsvlk8f23.life

    v3jmvczsden.life

    8vpndr56eb1.life

    5gbcnik1ba0.life

    k6r11hdxxm2.life

    wc87pfwqvbx.life

    3b73akpd5ip.life

    5o5f0or1704.life

    ve0tcgv0oks.life

    tsd7d3pynml.life

    kfjgd8tquo8.life

    ff7xb5l0zl5.life

    27qrg2npbhu.life

    fvawc0jtdkp.life

  • dga_seed

    OKFsgukk

  • domain_length

    11

  • num_dga_domains

    100

  • port

    443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\name.dll
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    PID:3648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3648-0-0x0000000001FD0000-0x0000000002049000-memory.dmp

    Filesize

    484KB

    Download

  • memory/3648-2-0x00007FFF48170000-0x00007FFF48365000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3648-1-0x0000000002170000-0x000000000227A000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/3648-4-0x00007FFF48170000-0x00007FFF48365000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3648-5-0x0000000002170000-0x000000000227A000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/3648-6-0x00007FFF48170000-0x00007FFF48365000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3648-3-0x0000000002170000-0x000000000227A000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/3648-7-0x0000000002170000-0x000000000227A000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/3648-8-0x00007FFF48170000-0x00007FFF48365000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3648-9-0x0000000001FD0000-0x0000000002049000-memory.dmp

    Filesize

    484KB

    Download

  • memory/3648-10-0x00007FFF48170000-0x00007FFF48365000-memory.dmp

    Filesize

    2.0MB

    Download