bumblebee | 17E93000000[.]bin[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
17E93000000.bin.exe
Size 1024KB
Sample230915-wpqfpseb8t
SHA256 af59ce785e062bf0d198eb4e3bdbc1ee57d58164de6dc1faf38836c670ef6f7d
MD5 0b7b1d42e60ceeff49ef796d4d4f5b14
SHA1 54a528d2f62b1af4c331f2c5ae03efdabc793833
SHA512 1c54198465f6b06934c269fbc51980837786eb0da7cafe2cb0ec676d2e5c24dade5370e4234c8b3790c42dc0f2fee27fc6588c1b7ec078ea72a22d1a05d40163
SSDEEP 24576:tAZBB0pE2CwPwsqqSUZ57pBloBph3xbjrYWw:pecDqqSOvloBPZj03
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lnk1 bumblebee

Malware Config

Extracted

Family

bumblebee

Botnet

lnk1

rc4.plain

Signatures

Bumblebee family
bumblebee

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17E93000000.bin.exe

File Explorer

17E93000000.bin.exe

.exe 1024KB

17E93000000.bin.exe

IMPHASH 0e7d77b31705b90280a066941e785013
SHA256 af59ce785e062bf0d198eb4e3bdbc1ee57d58164de6dc1faf38836c670ef6f7d
MD5 0b7b1d42e60ceeff49ef796d4d4f5b14
SHA1 54a528d2f62b1af4c331f2c5ae03efdabc793833
SHA512 1c54198465f6b06934c269fbc51980837786eb0da7cafe2cb0ec676d2e5c24dade5370e4234c8b3790c42dc0f2fee27fc6588c1b7ec078ea72a22d1a05d40163
SSDEEP 24576:tAZBB0pE2CwPwsqqSUZ57pBloBph3xbjrYWw:pecDqqSOvloBPZj03
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

359724

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shlwapi

PathCombineW StrCmpIW PathFindFileNameW PathRemoveExtensionW StrStrIW

kernel32

GetModuleFileNameA CreateEventW AreFileApisANSI ReadFile SetHandleInformation SetWaitableTimer TlsSetValue CreateNamedPipeA SetLastError EnterCriticalSection WriteFile TerminateProcess WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetQueuedCompletionStatus GetCurrentThreadId GetSystemDirectoryW PostQueuedCompletionStatus MultiByteToWideChar FormatMessageW GetLastError CreateFileA SetEvent TerminateThread TlsAlloc QueueUserAPC LocalFree DeleteCriticalSection VerSetConditionMask WideCharToMultiByte GetEnvironmentStrings SleepEx VerifyVersionInfoW TlsGetValue CreateProcessA TlsFree FormatMessageA CreateIoCompletionPort FreeEnvironmentStringsA GetExitCodeProcess GetProcAddress GetModuleHandleW Sleep GetCurrentProcess Thread32Next Thread32First GetModuleHandleA LoadLibraryA VirtualProtectEx OpenThread HeapFree lstrlenA CreateFileW HeapReAlloc HeapAlloc GetProcessHeap GetModuleFileNameW SetFilePointer lstrcmpA GetFileAttributesA Wow64DisableWow64FsRedirection ExpandEnvironmentStringsW Wow64RevertWow64FsRedirection GetWindowsDirectoryW GetCurrentDirectoryW GlobalMemoryStatusEx GetFileAttributesW GetStdHandle QueryPerformanceFrequency QueryPerformanceCounter RaiseException HeapSize WriteConsoleW WaitForSingleObject CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot GetCurrentProcessId CopyFileA lstrcatA FindClose SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW DecodePointer GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileA EncodePointer RtlPcToFileHeader CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind OpenProcess FindFirstFileExA GetTimeZoneInformation GetOEMCP IsValidCodePage SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType ExitProcess GetACP GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime

user32

GetCursorPos FindWindowW

advapi32

RegQueryValueExW CryptGenRandom CryptReleaseContext CryptAcquireContextW GetUserNameW CloseServiceHandle OpenSCManagerW EnumServicesStatusExW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW LookupPrivilegeValueW

shell32

SHGetSpecialFolderPathA SHGetSpecialFolderPathW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoInitializeSecurity CoUninitialize

oleaut32

SafeArrayGetUBound SafeArrayGetElement SafeArrayGetLBound SafeArrayUnaccessData SafeArrayAccessData SysFreeString SysAllocString VariantClear VariantInit

mpr

WNetGetProviderNameW

iphlpapi

GetAdaptersInfo

wtsapi32

WTSEnumerateProcessesA WTSFreeMemory

ws2_32

htons inet_addr inet_ntop closesocket recv send setsockopt WSAGetLastError connect socket WSAStartup getsockname getaddrinfo freeaddrinfo WSACleanup

rpcrt4

RpcServerRegisterIfEx RpcMgmtStopServerListening RpcServerListen NdrServerCall2 RpcBindingFree RpcServerUnregisterIf RpcServerUseProtseqEpA

Name

.text

Size

632KB

Virtual Size

631KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

275KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

74KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ