Behavioral task
behavioral1
Sample
1636-54-0x0000000001ED0000-0x0000000002031000-memory.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1636-54-0x0000000001ED0000-0x0000000002031000-memory.dll
Resource
win10v2004-20221111-en
General
-
Target
1636-54-0x0000000001ED0000-0x0000000002031000-memory.dmp
-
Size
1.4MB
-
MD5
7d46af37739cda3b88214a7b1b54cb3e
-
SHA1
2da49809ee7dc7be2a3edf0cbe14898af8f08b81
-
SHA256
6d2d258faab9d02803d0c6f3b744476c72ba36178a526a8ef2b838e9c8dd883d
-
SHA512
4c535563a2a78a716008aa0d27b9e90492a56c008cc9903ef5ccf4f867f1d44b684ca1989c12bb24fde03ffca2487dd6da2ead6f0835bcccd4dc65d434af77c4
-
SSDEEP
24576:ohPwJ9+CadFPRChkPRC8TKeCIHB+p9Zx/IfkZKdYq8IeNR6lkCS:YnPskPRTTKvIh+p9Zx/jYdvbGRsj
Malware Config
Extracted
bumblebee
tokdll
195.20.17.233:443
192.111.146.189:443
62.113.238.73:443
Signatures
-
Bumblebee family
Files
-
1636-54-0x0000000001ED0000-0x0000000002031000-memory.dmp.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 879KB - Virtual size: 879KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 344KB - Virtual size: 343KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 83KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ