Overview

overview

10

Static

static

3

0x00060000...22.dll

windows7-x64

10

0x00060000...22.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-02-2024 17:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0x0006000000022ea1-22.dll

  • Size

    2.1MB

  • MD5

    bedb0f369ebb79dbcf856379ecb6566c

  • SHA1

    4a8c27c1a2f0be31b73fdad222782648c9ce6b0c

  • SHA256

    189046093d0018570c1d9a12ad4aca14d4ccd65fb63d228275fd7067c24d2ecd

  • SHA512

    06a3d60bf011453711d2f1df385b28edc3815f6e108567169690821b3085b8fda526a123cfbacb6e42290a0576fa878c41cdebef77609367965df12a159a02ee

  • SSDEEP

    49152:onP1vdcvQ6fxh8KENpyRqBHffpWiEWh5n7:2o5JeKKpyRqNJMWb7

Score
10/10
bumblebeeonkomsi2loader

Malware Config

Extracted

Family

bumblebee

Botnet

onkomsi2

Attributes
  • dga

    n64c2akw.life

    zefawfb0.life

    dph3pby8.life

    hx0hysyg.life

    1qa3k743.life

    luw8ubf2.life

    rbvsf6io.life

    4huoqrsp.life

    8qwcvseh.life

    37zi55wc.life

    i9f44mju.life

    aqnx9c9h.life

    3nmeg5wa.life

    r5ue5rok.life

    et53yjoc.life

    tvgco82h.life

    0xtmu3tz.life

    6xhpschv.life

    6o26tws0.life

    0oz7923s.life

    54y2q50j.life

    9hh7hq5r.life

    r0ca080m.life

    43vtghfz.life

    qal55els.life

    p5e68m36.life

    x698iah6.life

    kqn0zkig.life

    wq6w8jkq.life

    i6n08gx7.life

  • dga_seed

    anjd78ka

  • domain_length

    8

  • num_dga_domains

    100

  • port

    443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0x0006000000022ea1-22.dll
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    PID:3560
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5192 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1540

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3560-0-0x00000000027E0000-0x00000000028C7000-memory.dmp

      Filesize

      924KB

      Download

    • memory/3560-1-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/3560-2-0x0000000002B10000-0x0000000002D28000-memory.dmp

      Filesize

      2.1MB

      Download

    • memory/3560-3-0x0000000002B10000-0x0000000002D28000-memory.dmp

      Filesize

      2.1MB

      Download

    • memory/3560-4-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/3560-5-0x0000000002B10000-0x0000000002D28000-memory.dmp

      Filesize

      2.1MB

      Download

    • memory/3560-6-0x0000000002B10000-0x0000000002D28000-memory.dmp

      Filesize

      2.1MB

      Download

    • memory/3560-7-0x00000000027E0000-0x00000000028C7000-memory.dmp

      Filesize

      924KB

      Download

    • memory/3560-8-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/3560-9-0x00007FFEF6070000-0x00007FFEF6265000-memory.dmp

      Filesize

      2.0MB

      Download