Bumblebee first appeared around March 2022. It delivers Cobalt Strike, Meterpreter, shellcode and in some cases ransomware, and it largely took over the role BazarLoader had. It is called Bumblebee after the unusual User-Agent string it sends.
Delivery
ISO mounted by the user
-> shortcut (LNK) with the run command
-> hidden 64-bit DLL next to it
LNK: cmd.exe /c powershell -WindowStyle Hidden -Command
".\7za.exe x arch.7z -p<password> -o"c:\programdata" -y > $null;
rundll32 c:\programdata\arch.dll,<export>"
The archive password is passed on the command line and the extracted DLL runs through rundll32 with a specific export name. Later PDF-delivered samples used the same loader.
Loader behaviour
- A Windows event object serves as the single-instance check, in the same way others use a mutex.
- It enumerates the system with WMI queries (computer system and product).
- Anti-analysis checks look for security tools, virtual machine artefacts and unusual user names.
- It generates random numbers with its own PRNG.
- Two binaries are embedded inside: a 32-bit one used for injection and a 64-bit one for communication with the server.
Command strings
Shi shellcode injection
Dij DLL injection
Dex download an executable (stored in AppData as Wab.exe)
Sdl uninstall the loader
Ins enable persistence and run the VBS script
Persistence works by copying itself into a new AppData folder and running a hard-coded VBS that starts a rundll32 call.
The crypter layer
Under the loader is a crypter DLL with a single export (ordinal 1). It is run in an x64 debugger via rundll32 and ordinal 1. Large decrypt-and-shuffle loops over heap memory produce the payload, whose two exports confirm what the payload analysis showed.
Tags tell you where it goes
The configuration contains a group tag, and each tag corresponds to a type of follow-on server.
2504r / 2704r Cobalt Strike servers
2004r / 25html Meterpreter servers
VPS1G Cobalt Strike
VPS2G ransomware group