Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
08-12-2024 19:01
General
-
Target
9a149522394b1718586436d43d72a9c9fece1f5c63478b6045b99421a35afecb.dll
-
Size
1.0MB
-
MD5
63f8c02fa87e750af09aad4f48b1aa4b
-
SHA1
f6554c45d574e960ed5f262779ff5aaeb928384e
-
SHA256
9a149522394b1718586436d43d72a9c9fece1f5c63478b6045b99421a35afecb
-
SHA512
017adaaf9791fd90906f2f0f7e713bd0ed48075cc2838247d730ef9411a0089f98fc6ad33d0813367dff486bb27e4a5fe4c8123f887f36deddd0f3f986a235e0
-
SSDEEP
24576:dTOm8Acqmr0tSEud7LgCgF1ZlPluqzGfGhu7h:dzcZotSwCgHEqzG+4
Score
10/10
Malware Config
Extracted
Family
bumblebee
Botnet
132lg
C2
205.185.113.34:443
103.144.139.146:443
23.106.223.222:443
95.168.191.248:443
23.106.223.182:443
146.70.29.237:443
rc4.plain
Signatures
-
BumbleBee
BumbleBee is a loader malware written in C++.
-
Bumblebee family
-
Blocklisted process makes network request 7 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a149522394b1718586436d43d72a9c9fece1f5c63478b6045b99421a35afecb.dll,#11⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
508KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.4MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
508KB
-
Filesize
1.7MB