ProcessLoad
Behavioral task
behavioral1
Sample
Attachments.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Attachments.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Attachments.lnk
Resource
win7-20240319-en
Behavioral task
behavioral4
Sample
Attachments.lnk
Resource
win10v2004-20240226-en
General
-
Target
6214e19836c0c3c4bc94e23d6391c45ad87fdd890f6cbd3ab078650455c31dc8
-
Size
1.0MB
-
MD5
f411c1a716639d477d0838bba30a8fbb
-
SHA1
8100df98a73a8a037b4085b86ff42af9c438f382
-
SHA256
6214e19836c0c3c4bc94e23d6391c45ad87fdd890f6cbd3ab078650455c31dc8
-
SHA512
fbda76832d983221ae32ac4ff8a129efbad205f2f16d370e98d7329451da1e3941c25ea9c5629d79d4bbe6f46b853bcea6e2432a2a31221bcaaac7a02d445042
-
SSDEEP
24576:v78He7Xb4ZMhMdNI5BhlQmNeDiMkhSripiP4Ln2zt8GtHf4:vYHe7L4WhMQqiMksriN2zKCg
Malware Config
Extracted
bumblebee
VPS1GROUP
23.82.19.208:443
Signatures
-
Bumblebee family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/Attachments.dat
Files
-
6214e19836c0c3c4bc94e23d6391c45ad87fdd890f6cbd3ab078650455c31dc8.zip
-
Attachments-2206.iso.iso
-
Attachments.dat.dll windows:6 windows x64 arch:x64
bc1fc12dfcfbfb96d61fc1ad211049f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
TlsAlloc
QueueUserAPC
CreateWaitableTimerA
DeleteCriticalSection
VerSetConditionMask
SleepEx
TlsGetValue
GetSystemTimeAsFileTime
TlsFree
CreateIoCompletionPort
FileTimeToSystemTime
LoadLibraryW
GetLocalTime
GetProcAddress
SystemTimeToFileTime
GetModuleHandleW
GetCurrentProcess
Thread32Next
Thread32First
GetModuleHandleA
OpenProcess
LoadLibraryA
VirtualProtectEx
OpenThread
GetStdHandle
GetFileType
WriteFile
MultiByteToWideChar
SwitchToFiber
DeleteFiber
CreateFiber
WideCharToMultiByte
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GetTickCount
GlobalMemoryStatus
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetSystemTime
ReadFile
GetModuleFileNameW
SetFilePointer
lstrlenA
CreateFileW
lstrcmpA
TerminateThread
VirtualAlloc
HeapFree
CreateFileA
HeapReAlloc
HeapAlloc
GetFileSize
GetProcessHeap
VirtualQuery
lstrcpyA
GetFullPathNameW
GetCurrentDirectoryW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetEvent
CreateEventW
PostQueuedCompletionStatus
GetQueuedCompletionStatus
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
EnterCriticalSection
SetLastError
VerifyVersionInfoA
TlsSetValue
SetWaitableTimer
GetCurrentProcessId
ExitProcess
GetLastError
GetModuleHandleExA
Sleep
lstrcatA
GetModuleFileNameA
GetDriveTypeW
FindFirstFileW
SetEndOfFile
HeapSize
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExA
FindClose
GetTimeZoneInformation
OutputDebugStringW
SetStdHandle
SetFilePointerEx
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
WriteConsoleW
SetConsoleCtrlHandler
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
FreeLibrary
CreateDirectoryA
GetFileAttributesA
CloseHandle
CreateToolhelp32Snapshot
WaitForSingleObject
RtlUnwindEx
RaiseException
RtlPcToFileHeader
InterlockedFlushSList
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
InitializeSListHead
FormatMessageA
LocalFree
user32
GetUserObjectInformationW
GetProcessWindowStation
wsprintfW
MessageBoxW
advapi32
CryptDecrypt
LookupPrivilegeValueA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
GetUserNameW
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
shell32
SHGetSpecialFolderPathA
ole32
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
ws2_32
WSASocketW
getaddrinfo
connect
WSARecv
getsockopt
freeaddrinfo
WSASetLastError
setsockopt
WSAGetLastError
recv
send
select
WSASend
closesocket
ioctlsocket
WSACleanup
WSAStartup
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty
shlwapi
StrChrA
StrToIntA
Exports
Exports
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640KB - Virtual size: 640KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 124KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 468B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Attachments.lnk.lnk