Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/05/2026, 13:24
General
- Target tmpzxdxdc3m.dll
- Size 1.1MB
- Sample260522-qns8bact2m
- SHA256 8e04a2048e545d0faaf5d1e1c995c7b9529751e378b75c41f80c6682bd84e5aa
Malware Config
Extracted
-
bumblebee
-
js1
-
dga
v5b6ml4o0nq.life
d4mdwvwm8c8.life
6uwsby1vmyj.life
mp0zt8ctj70.life
tkqeai6tead.life
2xek4jch3xf.life
ugwfyzhao98.life
auq2lckl2e0.life
1odrw6y2sad.life
hk5ekbl02o8.life
knqbckw92x9.life
nnjg4uf5vij.life
nk4xgtjnvs9.life
7xbapl162fg.life
8djp3zmzbif.life
nojzch0pgfo.life
b9dsvlk8f23.life
v3jmvczsden.life
8vpndr56eb1.life
5gbcnik1ba0.life
k6r11hdxxm2.life
wc87pfwqvbx.life
3b73akpd5ip.life
5o5f0or1704.life
ve0tcgv0oks.life
tsd7d3pynml.life
kfjgd8tquo8.life
ff7xb5l0zl5.life
27qrg2npbhu.life
fvawc0jtdkp.life
-
dga_seed_string
OKFsgukk
-
domain_length
11
-
num_dga_domains
100
-
port
443
-
tld
.life
Signatures
- Family: BumbleBee
BumbleBee is a loader malware written in C++.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\tmpzxdxdc3m.dll1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3928-0-0x0000000000B20000-0x0000000000B99000-memory.dmp
memory/3928-1-0x00007FFCD706D000-0x00007FFCD706E000-memory.dmp
memory/3928-2-0x00000000024C0000-0x00000000025CA000-memory.dmp
memory/3928-5-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp
memory/3928-6-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp
memory/3928-4-0x00000000024C0000-0x00000000025CA000-memory.dmp
memory/3928-3-0x00000000024C0000-0x00000000025CA000-memory.dmp
memory/3928-7-0x00000000024C0000-0x00000000025CA000-memory.dmp
memory/3928-8-0x0000000000B20000-0x0000000000B99000-memory.dmp
memory/3928-9-0x00007FFCD6FD0000-0x00007FFCD71C5000-memory.dmp
memory/3928-10-0x00007FFCD706D000-0x00007FFCD706E000-memory.dmp