Overview

overview

10

Static

static

3

2024-05-09...uk.exe

windows7-x64

10

2024-05-09...uk.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09-05-2024 09:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-09_18c0d4d076dcf852682a1e928ea6fd20_ryuk.exe

  • Size

    1.4MB

  • MD5

    18c0d4d076dcf852682a1e928ea6fd20

  • SHA1

    d728085c03e3586ac11b558b59872b440d01c544

  • SHA256

    8a1a0b4872c74737fa67fd233e4a2546412c4a442ebd04022e680cb37b7aedac

  • SHA512

    a17e02991f7edca6ac477dba336d9c32acf03238eca23d1df31ab6cdb03fb976fb1a20c526cc06a94c9b3fd7a853232943bcdf11d77414e9058493d73ab865b0

  • SSDEEP

    24576:dQTkuS3lgPzjmR4JcIn652Y0/oHTTvN718HGO8YIH5A70HQq8lJ2Wd:dQopEPmRpIn652Y0M528YC5dHSlJv

Score
10/10
bumblebeeasd1234loader

Malware Config

Extracted

Family

bumblebee

Botnet

asd1234

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Detects executables referencing combination of virtualization drivers 1 IoCs
  • Detects executables referencing virtualization MAC addresses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-09_18c0d4d076dcf852682a1e928ea6fd20_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-09_18c0d4d076dcf852682a1e928ea6fd20_ryuk.exe"
    1⤵
      PID:2712

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2712-0-0x00000000000C0000-0x00000000001BF000-memory.dmp

      Filesize

      1020KB

      Download

    • memory/2712-1-0x00000000006E0000-0x00000000008F4000-memory.dmp

      Filesize

      2.1MB

      Download