bumblebee | 31b72e1c246b4f38e70f9c8c556a626b15736589860f3231001bb4ebae749239

Sharing

Copy URL Twitter E-mail

General

Target
tmp1_cit3e4
Size 8.2MB
Sample260609-a9ap4aav5n
SHA256 31b72e1c246b4f38e70f9c8c556a626b15736589860f3231001bb4ebae749239
MD5 2df80283a8c95b24b9c057bc8274c14b
SHA1 ed61db573ef82b42d519aefff15ee157054ed158
SHA512 03193a2986bf6f5c3bd6dc38e4b47bf5d7070f45fe1dfa8c54158abf3366a28afa45c1bf9039798a9a350f848f7d6eb58b6c656b88b0be8a08190ff4bf5cd67f
SSDEEP 196608:qYArVsCUdqt33xvKkkar0JxzvoMjsLrYu7KDxn:qYgVsCb3VbozvmYsKV
TLSH
T1EA96F12276CBC036E56D0172A63EEE7B903DBE230B7140D763D47D2E69748C26A35A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

bumblebee

Botnet

9090

Attributes

dga
nvg55tpgvn.click

ulbun31qmv.click

7oc6be5fmy.click

bm76b9296k.click

h7xupkk0d3.click

fi7anseaj7.click

0u4bcayb8u.click

1cckgd13z5.click

562z75s3bp.click

1smmlbbiqr.click

cc5fi2q6ca.click

xisdha07tt.click

rvi6iv6l5v.click

kddpj0gryr.click

jmpxjjqhe8.click

ui1b0rvu0k.click

kqiqovthoj.click

zbldvupsdc.click

qdhqoj9s20.click

g841i9ksgn.click

uu4cx79e90.click

m9a2qfmqay.click

kc8svtokry.click

st9rdv9xai.click

i4965hr9jc.click

wkxfgjwonu.click

53y5nwsc6j.click

7ou7og586r.click

r5wrzrk1bi.click

am7gd0loc1.click

a2cey1j0xl.click

il1nlb7tn0.click

d7x2whgood.click

b5sqn635n9.click

nox7lvewcl.click

5buum8t9vl.click

fb25x2ju7i.click

ral9rhuaxy.click

mt9ycu98jr.click

8vndou1xlz.click

ul6105p00e.click

9hqid2tzng.click

lxw6duivu7.click

0dhalnnwr5.click

p6xuzncl71.click

lwpk3miw9n.click

t792ufhvll.click

o0fivl26q7.click

hmh20ykvlf.click

ixu6xial6v.click

dv14q2l82c.click

wz4pnl68jg.click

6709v1hcy1.click

x0822sepnx.click

ft8qxfxurc.click

64ud5xnryz.click

gflgt8sbzn.click

27c28lnp3v.click

g2to6sz5pi.click

i76uhrb930.click

h3p2sxyyk8.click

g90uubdr4p.click

nmgyqyrb8b.click

a53faphpe4.click

2wqfxxycnk.click

xa7wlz3r5y.click

27v2bofhl4.click

uc38lfln1t.click

akk5t6frjq.click

kiuxl1yijx.click

689c3d8ylq.click

3j6smer0tm.click

b8w2qcig4n.click

85ciukct31.click

b4j8gnyy3a.click

roc72ievev.click

3sehf3t4x5.click

hztr0qlwke.click

vig3u2t4fm.click

ehca1iots2.click

b4c6xa0j4f.click

y65z9jsgrh.click

a9ph8qf8d6.click

lp09sfynbd.click

62dp72sdft.click

7y2yvpkuff.click

y3hhmeydtr.click

kh2e843low.click

bao2cdlwd0.click

ufbt7kts4x.click

dls5ae3bfp.click

cbwsfxcdei.click

56azbsx5nm.click

rjafv9rkqq.click

cjbdm0nhub.click

xt58p1nya3.click

6y3igtg9t6.click

4q3m78acq6.click

rjj19c1jpn.click

nepygxz419.click
dga_seed
-5372979216912523469
domain_length
10
num_dga_domains
300
port
443
tld
.click

rc4.plain

Targets

- Target
  tmp1_cit3e4
- Size 8.2MB
- SHA256 31b72e1c246b4f38e70f9c8c556a626b15736589860f3231001bb4ebae749239
- MD5 2df80283a8c95b24b9c057bc8274c14b
- SHA1 ed61db573ef82b42d519aefff15ee157054ed158
- SHA512 03193a2986bf6f5c3bd6dc38e4b47bf5d7070f45fe1dfa8c54158abf3366a28afa45c1bf9039798a9a350f848f7d6eb58b6c656b88b0be8a08190ff4bf5cd67f
- SSDEEP 196608:qYArVsCUdqt33xvKkkar0JxzvoMjsLrYu7KDxn:qYgVsCb3VbozvmYsKV
- TLSH
  T1EA96F12276CBC036E56D0172A63EEE7B903DBE230B7140D763D47D2E69748C26A35A17
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

9090 defense_evasion discovery bumblebee loader persistence privilege_escalation ransomware trojan
- Family: BumbleBee
  BumbleBee is a loader malware written in C++.
  loader bumblebee
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: BumbleBee

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Checks installed software on the system

Checks whether UAC is enabled

Enumerates connected drives

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3