dataCheck
setPath
Behavioral task
behavioral1
Sample
bumble_0109.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bumble_0109.dll
Resource
win10v2004-20220812-en
Target
bumble_0109.dll
Size
1.1MB
MD5
0d7741358483574dde864c7b1e4b2a77
SHA1
2a3327889c1b0812d43b669143c532d65b0b847a
SHA256
29fc401b9488bea68571f46be82e3576e027504233b2a32111e634eb3c943b55
SHA512
500d9a5fcb87da0e7c84c067d30662dcce0dd8402c2d98443ce2d300946b3a7cabd89f84ef9c77d087bf6c1930a0ccb0e5effee2d339448987797cef7dfdf699
SSDEEP
24576:6x2ubccfCEN1Wpv9hOQn7G9Zx/tGggFQhrxtxbdAeow:aTCyWN9QQnq9Zx/ZgShrxt/Aeo
bumblebee
2908
49.90.128.0:259
82.164.203.153:390
226.103.15.6:476
204.63.46.16:298
134.66.180.254:397
172.239.204.162:211
151.12.102.30:408
127.163.249.9:278
161.124.131.243:153
230.158.249.130:364
37.176.144.6:127
33.86.39.162:247
129.35.138.157:129
4.211.195.124:422
96.187.65.205:397
19.206.185.249:302
46.63.248.114:321
238.8.10.238:407
169.114.71.135:178
142.11.234.228:443
119.83.73.136:382
22.143.49.205:450
147.141.15.0:173
163.193.222.130:415
240.246.225.75:305
169.16.87.11:222
128.128.251.228:348
188.73.188.42:245
155.137.8.60:376
103.172.189.145:287
231.48.190.130:170
83.46.36.177:266
1.128.207.160:157
43.122.160.37:278
246.59.14.231:325
149.201.25.67:366
15.167.113.56:176
176.94.31.206:261
146.53.67.106:469
241.127.148.158:419
231.67.4.25:402
114.68.4.241:161
178.169.20.116:453
51.68.145.40:443
4.188.224.254:128
71.68.150.16:423
92.79.97.114:130
77.7.166.196:269
147.228.234.145:241
82.177.114.85:495
30.219.17.254:335
142.11.234.230:443
115.122.116.77:306
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
CertCreateCertificateChainEngine
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
InitSecurityInterfaceA
CreateEventW
Sleep
SetEvent
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
SetThreadContext
SetWaitableTimer
TlsSetValue
SetLastError
EnterCriticalSection
CreateWaitableTimerW
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
PostQueuedCompletionStatus
FormatMessageW
GetLastError
TerminateThread
TlsAlloc
QueueUserAPC
LocalFree
DeleteCriticalSection
VerSetConditionMask
WideCharToMultiByte
SleepEx
VerifyVersionInfoW
TlsGetValue
TlsFree
FormatMessageA
CreateIoCompletionPort
AreFileApisANSI
ReadFile
SetHandleInformation
CreateNamedPipeA
WriteFile
TerminateProcess
GetCurrentThreadId
GetSystemDirectoryW
MultiByteToWideChar
CreateFileA
GetEnvironmentStrings
CreateProcessA
FreeEnvironmentStringsA
GetExitCodeProcess
LoadLibraryW
Thread32Next
Thread32First
GetModuleHandleA
LoadLibraryA
VirtualProtectEx
OpenThread
GetModuleFileNameW
SetFilePointer
lstrlenA
CreateFileW
lstrcmpA
lstrcatA
HeapFree
HeapReAlloc
HeapAlloc
GetFileSize
GetProcessHeap
Wow64DisableWow64FsRedirection
ExpandEnvironmentStringsW
Wow64RevertWow64FsRedirection
GetWindowsDirectoryW
GetCurrentDirectoryW
GlobalMemoryStatusEx
GetFileAttributesW
GetStdHandle
RtlCaptureContext
WaitForSingleObjectEx
ResetEvent
WriteConsoleW
GetCurrentProcess
GetFileAttributesA
OpenProcess
GetModuleFileNameA
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
WaitForSingleObject
SetFilePointerEx
HeapSize
GetCPInfo
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
RaiseException
DecodePointer
EncodePointer
RtlPcToFileHeader
RtlVirtualUnwind
ResumeThread
GetCommandLineA
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ExitProcess
GetACP
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
RtlUnwindEx
InterlockedFlushSList
InitializeSListHead
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlLookupFunctionEntry
FindWindowW
RegQueryValueExW
GetUserNameW
RegOpenKeyExW
RegCloseKey
LookupPrivilegeValueW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
CoCreateInstance
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
SafeArrayGetUBound
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
SysFreeString
SysAllocString
VariantClear
VariantInit
WNetGetProviderNameW
GetAdaptersInfo
WSASetLastError
select
WSASend
WSASocketW
WSAGetLastError
setsockopt
getaddrinfo
ioctlsocket
freeaddrinfo
getsockopt
WSARecv
WSACleanup
connect
closesocket
WSAStartup
PathCombineW
StrCmpIW
StrStrIW
dataCheck
setPath
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ