Light

Episode #885 Quiz

THE BUMBLEBEE LOADER
Date: 2022-08-23 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Bumblebee is a phishing-delivered malware loader using ISO archives, LNK shortcuts, and living-off-the-land binaries like odbcconf.exe, fodhelper.exe, reg.exe, procdump64.exe, and rclone.exe to inject Meterpreter and Cobalt Strike, escalate via Zerologon, dump LSASS and registry hives, steal ntds.dit, enable lateral movement, persistence, and exfiltration.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What specific Windows utility does the Bumblebee LNK file invoke to load the initial DLL payload via a response file?

Question 1

What specific Windows utility does the Bumblebee LNK file invoke to load the initial DLL payload via a response file?

fodhelper.exe wmiprvse.exe rundll32.exe odbcconf.exe

Question 2: Which pair of existing Windows executables were spawned and then injected with Meterpreter and Cobalt Strike, respectively?

Question 2

Which pair of existing Windows executables were spawned and then injected with Meterpreter and Cobalt Strike, respectively?

rundll32.exe and procdump64.exe wabmig.exe and wab.exe lsass.exe and tasklist.exe netview.exe and nltest.exe

Question 3: Which exploit did Bumblebee load to perform privilege escalation before continuing its post-exploitation sequence?

Question 3

Which exploit did Bumblebee load to perform privilege escalation before continuing its post-exploitation sequence?

CVE-2020-1472 Zerologon CVE-2022-32893 WebKit out-of-bounds CVE-2022-2856 Chrome zero-day CVE-2022-27255 Realtek SIP overflow

Question 4: Which three registry hives did Bumblebee save with reg.exe before compressing and exfiltrating them?

Question 4

Which three registry hives did Bumblebee save with reg.exe before compressing and exfiltrating them?

HKLM\SAM, HKLM\Security, and HKLM\System NTDS.dit, SYSTEM, and SOFTWARE HKCU\Software, HKCU\Classes, and HKLM\Software HKLM\DEFAULT, HKU\.DEFAULT, and HKCR

Question 5: According to the timeline Cybereason compiled, how long did Bumblebee's observed intrusion take from initial access to completion of Rclone exfiltration?

Question 5

According to the timeline Cybereason compiled, how long did Bumblebee's observed intrusion take from initial access to completion of Rclone exfiltration?

72 hours 19 hours 6 hours 24 hours

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.