Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • submitted
    20-11-2024 03:32

General

  • Target

    2024-11-20_680a9c63e6d459a8c7c75360122f98d4_hijackloader_ryuk.exe

  • Size

    1.4MB

  • MD5

    680a9c63e6d459a8c7c75360122f98d4

  • SHA1

    b8db117430c39820303e27d40883ab3c8508cf05

  • SHA256

    9095393d34997cae8c568522d92b7ff1e4358e59a46be58453be8c5ac7da6042

  • SHA512

    4261f9a82d8c4b4867ac1946e0d0427e76ca80804340b93b6d59ba6c30eb21093f7dac918143763beb6b4674aea2734df89f31bf9afab6b811466eb933548376

  • SSDEEP

    24576:n9pfBeNtiWaDzOaB7E2qh/s3nI+msqTuToBGq1SN8:HioW0zOaB7E2C/s3IRDGqh

Score
10/10

Malware Config

Extracted

Family

bumblebee

Botnet

21maca

C2

108.62.141.20:443

104.168.140.145:443

51.68.145.171:443

108.62.118.170:443

192.119.72.133:443

23.108.57.201:443

rc4.plain

Signatures

  • BumbleBee

    BumbleBee is a loader malware written in C++.

  • Bumblebee family
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-20_680a9c63e6d459a8c7c75360122f98d4_hijackloader_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-20_680a9c63e6d459a8c7c75360122f98d4_hijackloader_ryuk.exe"
    1⤵
    • Suspicious use of NtCreateThreadExHideFromDebugger
    PID:840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/840-0-0x0000027B1E3F0000-0x0000027B1E47B000-memory.dmp

    Filesize

    556KB

  • memory/840-1-0x00007FFB2874D000-0x00007FFB2874E000-memory.dmp

    Filesize

    4KB

  • memory/840-2-0x0000027B1E5E0000-0x0000027B1E741000-memory.dmp

    Filesize

    1.4MB

  • memory/840-4-0x00007FFB286B0000-0x00007FFB288A5000-memory.dmp

    Filesize

    2.0MB

  • memory/840-3-0x00007FFB286B0000-0x00007FFB288A5000-memory.dmp

    Filesize

    2.0MB

  • memory/840-5-0x00007FFB286B0000-0x00007FFB288A5000-memory.dmp

    Filesize

    2.0MB

  • memory/840-6-0x0000027B1E5E0000-0x0000027B1E741000-memory.dmp

    Filesize

    1.4MB

  • memory/840-7-0x0000027B1E5E0000-0x0000027B1E741000-memory.dmp

    Filesize

    1.4MB

  • memory/840-8-0x0000027B1E3F0000-0x0000027B1E47B000-memory.dmp

    Filesize

    556KB

  • memory/840-9-0x00007FFB286B0000-0x00007FFB288A5000-memory.dmp

    Filesize

    2.0MB

  • memory/840-10-0x00007FFB2874D000-0x00007FFB2874E000-memory.dmp

    Filesize

    4KB