bumblebee | LdrAddx64[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

LdrAddx64.dll
Size

2.1MB
MD5

dbd624af8f34d5e90c72cbb27d362fa2
SHA1

671ede491eacd61bbbd0410886b639a2d889f6cf
SHA256

dfb116f06421117af6c19b05306445187aaa85f3b001b3a0bf2ecf277b8fe5b4
SHA512

1f066b9b0d3701290e22f7aa33edbddcda2635c691959785d76814d8eafd1ce0c7ac8e575602e98b2bc49f5536d5fd0f665cc6e7fa90099ce70b790da68e3a83
SSDEEP

49152:JQjC/Py8joN9Tmk76/l5hZsuF9Zx/NZzRTSNhXvPZzYqq/:J9/69TWlpnZzRKhKq

Score

10^/10

9090 bumblebee

Malware Config

Extracted

Family

bumblebee

Botnet

9090

Attributes

dga_seed
-5372979216912523469
domain_length
10
num_dga_domains
300
port
443

rc4.plain

Signatures

Bumblebee family
bumblebee

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LdrAddx64.dll

Files

LdrAddx64.dll
.dll windows:6 windows x64 arch:x64

b6a6c47340e1ba7e9f3019db8b4f37f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

shlwapi

StrStrIW
PathRemoveExtensionW
PathFindFileNameW
PathCombineW
StrCmpIW

kernel32

SetWaitableTimer
TlsSetValue
CreateNamedPipeA
SetLastError
EnterCriticalSection
WriteFile
TerminateProcess
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
GetCurrentThreadId
GetSystemDirectoryW
PostQueuedCompletionStatus
MultiByteToWideChar
FormatMessageW
GetLastError
CreateFileA
TerminateThread
TlsAlloc
QueueUserAPC
LocalFree
DeleteCriticalSection
VerSetConditionMask
WideCharToMultiByte
GetEnvironmentStrings
SleepEx
VerifyVersionInfoW
TlsGetValue
CreateProcessA
TlsFree
FormatMessageA
CreateIoCompletionPort
FreeEnvironmentStringsA
GetExitCodeProcess
LoadLibraryW
GetProcAddress
GetModuleHandleW
SystemTimeToFileTime
GetCurrentProcess
Thread32Next
Thread32First
GetModuleHandleA
LoadLibraryA
VirtualProtectEx
OpenThread
HeapFree
lstrlenA
CreateFileW
HeapReAlloc
HeapAlloc
GetFileSize
GetProcessHeap
GetModuleFileNameA
GetModuleFileNameW
SetFilePointer
lstrcmpA
UnlockFileEx
LockFileEx
Wow64DisableWow64FsRedirection
ExpandEnvironmentStringsW
Wow64RevertWow64FsRedirection
GetWindowsDirectoryW
LocalAlloc
GetCurrentDirectoryW
GlobalMemoryStatusEx
GetTickCount
GetFileAttributesW
SetHandleInformation
GetSystemInfo
GetStdHandle
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
AreFileApisANSI
OutputDebugStringA
LockFile
InitializeCriticalSection
GetFullPathNameA
SetEndOfFile
CreateMutexW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
CreateEventW
GetFileAttributesA
Sleep
OpenProcess
CloseHandle
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
WaitForSingleObject
GetCurrentProcessId
CopyFileA
lstrcatA
DeleteFileW
FindClose
GetTempPathW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleMode
GetConsoleCP
GetFileType
ExitProcess
GetACP
GetModuleHandleExW
FreeLibraryAndExitThread
ReadFile
ExitThread
CreateThread
LoadLibraryExW
RtlUnwindEx
InterlockedFlushSList
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ResetEvent
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
QueryPerformanceFrequency
RaiseException
DecodePointer
EncodePointer
RtlPcToFileHeader
DisableThreadLibraryCalls
GetDiskFreeSpaceW
SetEvent

user32

FindWindowW
GetCursorPos

advapi32

RegOpenKeyW
RegGetValueW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
CloseServiceHandle
OpenSCManagerW
EnumServicesStatusExW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
GetUserNameW
RegQueryValueExW
LookupPrivilegeValueW
RegCloseKey
RegSetValueExW
RegCreateKeyW

shell32

SHGetSpecialFolderPathW
SHGetSpecialFolderPathA

ole32

CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket

oleaut32

SysFreeString
VariantInit
SafeArrayAccessData
SysAllocString
SafeArrayUnaccessData
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayGetUBound
VariantClear

mpr

WNetGetProviderNameW

iphlpapi

GetAdaptersInfo

wtsapi32

WTSFreeMemory
WTSEnumerateProcessesA

wininet

InternetOpenA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA

ws2_32

htons
inet_ntop
connect
socket
getsockname
inet_addr
closesocket
WSAStartup
WSACleanup
recv
select
send
setsockopt
WSASetLastError
WSAGetLastError
inet_ntoa
getaddrinfo
__WSAFDIsSet
ioctlsocket
getsockopt
freeaddrinfo

rpcrt4

RpcServerUseProtseqEpA
RpcMgmtStopServerListening
RpcServerListen
RpcServerUnregisterIf
RpcBindingFree
NdrServerCall2
RpcServerRegisterIfEx

dnsapi

DnsFree
DnsQuery_A

Exports

Exports

dataCheck
setPath

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 420KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

b6a6c47340e1ba7e9f3019db8b4f37f8

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

mpr

iphlpapi

wtsapi32

wininet

ws2_32

rpcrt4

dnsapi

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 420KB - Virtual size: 420KB

.data Size: 96KB - Virtual size: 96KB

.pdata Size: 76KB - Virtual size: 76KB

.gfids Size: 4KB - Virtual size: 4KB

.tls Size: 8KB - Virtual size: 8KB

.reloc Size: 12KB - Virtual size: 12KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 420KB - Virtual size: 420KB

.data
Size: 96KB - Virtual size: 96KB

.pdata
Size: 76KB - Virtual size: 76KB

.gfids
Size: 4KB - Virtual size: 4KB

.tls
Size: 8KB - Virtual size: 8KB

.reloc
Size: 12KB - Virtual size: 12KB