Overview

overview

10

Static

static

3

fd320a7550...df.dll

windows7-x64

10

fd320a7550...df.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • submitted
    28-04-2024 04:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fd320a755022e6c79c245ad70e2324f6640feb23ef0787d2d54a572b90cabadf.dll

Score
10/10
bumblebeeasd123loader

Malware Config

Extracted

Family

bumblebee

Botnet

asd123

Attributes
  • dga

    d00d7ks32.life

    11qet4bgg.life

    2a6m2wkiq.life

    xky2lv24m.life

    cmau5xobd.life

    upxamcuma.life

    z1hf83vee.life

    yk37wagdg.life

    ajl0toabj.life

    qqpjqdylr.life

    1wrap3lnr.life

    z8g4klplp.life

    7clm8w86o.life

    nii34kqrw.life

    dl23dcg0p.life

    pwfkwiup6.life

    pltfrvss1.life

    z4aarde49.life

    4hdkyh1ns.life

    crbk7hduu.life

    p5zhkxu7x.life

    v4wlbpzf0.life

    qm4hupdsq.life

    go6nu8hgl.life

    gaamc74sm.life

    23b3imkqh.life

    9qf9v3tgq.life

    yg7kcxnie.life

    gebj02y46.life

    f0a3myb17.life

  • dga_seed

    -6773930237931557767

  • domain_length

    9

  • num_dga_domains

    100

  • port

    443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Bumblebee family
    bumblebee
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\fd320a755022e6c79c245ad70e2324f6640feb23ef0787d2d54a572b90cabadf.dll
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    PID:808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/808-0-0x0000000002530000-0x0000000002748000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/808-2-0x0000000002530000-0x0000000002748000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/808-3-0x00000000022F0000-0x0000000002527000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/808-1-0x0000000002530000-0x0000000002748000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/808-4-0x0000000002530000-0x0000000002748000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/808-6-0x00007FFFBD190000-0x00007FFFBD385000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/808-5-0x00007FFFBD190000-0x00007FFFBD385000-memory.dmp

    Filesize

    2.0MB

    Download