Behavioral task
behavioral1
Sample
696-142-0x00000000028C0000-0x0000000002AD8000-memory.dll
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
696-142-0x00000000028C0000-0x0000000002AD8000-memory.dll
Resource
win10v2004-20231020-en
General
-
Target
696-142-0x00000000028C0000-0x0000000002AD8000-memory.dmp
-
Size
2.1MB
-
MD5
5295c807c10f1633b5bdc3eaf93b4a23
-
SHA1
f46f5883cbcf6070bf970cd747156c4673ca4159
-
SHA256
39d25ae018564c6c2e465a05c6bb33b6b4251c633b4faa558bd5529235c63c6a
-
SHA512
62211308c746b7f23354b8526ce94403aa4b6bbed795e80764a2bdc3a4defc97aff4d6110fab3ef623ac693dbb9de8cd2691719bf21a7d1da5d59e205ff48e0a
-
SSDEEP
49152:AEwBRVTf0Tk27H1X06kSm9abZ9Zx/B3/4JAs/Xf0zPJ:VwrL27Dkr63/4u
Malware Config
Extracted
bumblebee
onkomsi2
-
dga
n64c2akw.life
zefawfb0.life
dph3pby8.life
hx0hysyg.life
1qa3k743.life
luw8ubf2.life
rbvsf6io.life
4huoqrsp.life
8qwcvseh.life
37zi55wc.life
i9f44mju.life
aqnx9c9h.life
3nmeg5wa.life
r5ue5rok.life
et53yjoc.life
tvgco82h.life
0xtmu3tz.life
6xhpschv.life
6o26tws0.life
0oz7923s.life
54y2q50j.life
9hh7hq5r.life
r0ca080m.life
43vtghfz.life
qal55els.life
p5e68m36.life
x698iah6.life
kqn0zkig.life
wq6w8jkq.life
i6n08gx7.life
yykdmh0r.life
is45ipqt.life
btycmaq0.life
bei9dppm.life
3jhcm6ou.life
1q04n1r6.life
10ciy2hb.life
11ou1grl.life
83b0leyy.life
t31jn4t1.life
b24f19ne.life
igak9l9s.life
hkgd9kar.life
02uhomlq.life
zpy1vssg.life
j57fzy12.life
zmlly8xo.life
pe6r5tzc.life
cg4cuoyi.life
pyjijjlm.life
m3vc2ce4.life
p1p97dov.life
ep0kbvph.life
0rlxan4o.life
zdx0i18o.life
7kmzys39.life
e97igyz6.life
hjcbhzd8.life
az77sw77.life
d0k4fdaa.life
c9l8ri53.life
ay03u2te.life
t99iv15x.life
6a1fbhay.life
zna5lybe.life
vxyojl27.life
mddoknvi.life
2z2dl1og.life
vojg90l2.life
awr5omre.life
tcjcv520.life
aqjjchti.life
6qwim2j8.life
1p34o0do.life
8hxwl72r.life
wykpnxcx.life
o10qz4xe.life
7564a2mg.life
aiv8bb2b.life
jwyxm0f3.life
4soexc4m.life
3xqy6csn.life
3k8iq1nb.life
w2hje2t7.life
fra3xqrx.life
4r3inwrt.life
qhfoevow.life
a9nhflze.life
jpngew6a.life
baunjh6t.life
yqofro9q.life
uq034w07.life
oq36weoi.life
vv5sfo80.life
0req10rd.life
m4v4xq2f.life
1p24echu.life
ohwv1vpp.life
z2tp7x2v.life
q65io756.life
-
dga_seed
anjd78ka
-
domain_length
8
-
num_dga_domains
100
-
port
443
Signatures
-
Bumblebee family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 696-142-0x00000000028C0000-0x0000000002AD8000-memory.dmp
Files
-
696-142-0x00000000028C0000-0x0000000002AD8000-memory.dmp.dll windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 416KB - Virtual size: 416KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 87KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ