Analysis
-
max time kernel
139s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
submitted
29-11-2024 12:55
General
-
Target
DKyVKmgVSvviRl.bat
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
0411
C2
192.119.120.146:443
54.37.131.10:443
146.70.139.252:443
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a loader malware written in C++.
-
Bumblebee family
-
Blocklisted process makes network request 6 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\DKyVKmgVSvviRl.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32 aMLjTIhBvevLGx.dll,SendData2⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
472KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.3MB
-
Filesize
472KB
-
Filesize
2.0MB
-
Filesize
1.3MB