Behavioral task
behavioral1
Sample
2016-54-0x00000000020A0000-0x0000000002201000-memory.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2016-54-0x00000000020A0000-0x0000000002201000-memory.dll
Resource
win10v2004-20221111-en
General
-
Target
2016-54-0x00000000020A0000-0x0000000002201000-memory.dmp
-
Size
1.4MB
-
MD5
4e00b59873bf8ae0485876e7ddfd61f7
-
SHA1
36e33acefc52a18b01b4f59e7147651188554c10
-
SHA256
f7efeb8a5ab7d4e2674abfcd4e0b61aa10c1ee7b5090fbf816eb847a44e8e20c
-
SHA512
55d5fd1c3688589a1e33f4b16fd2dcec3ad373f9c08087211ecf8774fb092f34a1f9466e67f166811c8be303d5861366cf4060aa2bfff1337741e2a21fac39d1
-
SSDEEP
24576:ohPwJ9+CadFPRChkPRC8TKeCIHB+p9Zx/IfkZKdYq8I6Z36lyCS:YnPskPRTTKvIh+p9Zx/jYdvbe3sp
Malware Config
Extracted
bumblebee
tokdll
195.20.17.233:443
192.111.146.189:443
62.113.238.73:443
Signatures
-
Bumblebee family
Files
-
2016-54-0x00000000020A0000-0x0000000002201000-memory.dmp.dll windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 879KB - Virtual size: 879KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 344KB - Virtual size: 343KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 83KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ