bumblebee | tmpqn9rlct0

Sharing

Copy URL Twitter E-mail

General

Target
tmpqn9rlct0
Size 1024KB
Sample260609-bfmm8saw2p
SHA256 4fb42588606a6c65ed3c47fc1d41ed981b42aea1e82ef69717c06f7db9a769f6
MD5 37f89d4daabbe2c25760d0b630673529
SHA1 11c7b8163c10493593ad725affccb62759b8477c
SHA512 763da367ac32ad0053d32aed74460a34ca1798b2e1f4ec106be9ac805a86c0fba2744a077babd3ec3bffbe97e80ad446af4cbde6873a00d06d7464c8e6346668
SSDEEP 24576:tAZBB0pE2CwPwsqqSUZ57pBloBph3xbjrYWw:pecDqqSOvloBPZj03
TLSH
T10B258D19AEA881E5D077C07889B5A557FBB1B85A5B348BDF0390461E3F736E04E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

lnk1 loader bumblebee

Malware Config

Extracted

Family

bumblebee

Botnet

lnk1

Attributes

dga
cmid1s1zeiu.life

itszko2ot5u.life

3v1n35i5kwx.life

newdnq1xnl9.life

jkyj6awt1ao.life

ddrjv6y42b8.life

1pnhp5o5za1.life

y13iqvlfjl5.life

xp0btfgegbo.life

gpv3uw5tmy4.life

5d7rdf3layn.life

2aed6bvquxs.life

5t9oknzu433.life

sy53gmpuq1i.life

09cwff8wgdh.life

4elhq2521mw.life

b4arp834sch.life

s3iug4uiy7t.life

q1cvhi9onpu.life

m3j4htyodnu.life

dzzrhn9rvqa.life

uriqas6zede.life

tv45x1ukt9w.life

9dnuk0xl7yc.life

zro95b8zb3r.life

9da1kshoyuq.life

zph13yx1leo.life

0q6mvuo4wl6.life

nyoqtkpub9x.life

l1bnym8lg65.life

d63hq5crsun.life

f4te7v7fi28.life

oi27t509pny.life

xg2mddk9qrj.life

9uknixukwim.life

5ejt5qpx2oh.life

v9y5rypfhdj.life

aq59tsppo18.life

vdnizm8lcke.life

knof8y1kufn.life

mhwv3bpckbi.life

b4ycw3b0ztx.life

tu0t62osn5m.life

pkgbfa9ati6.life

wd60v3x8mun.life

qpgomg0nfob.life

9619skmuswk.life

10fa4glizbq.life

h9cgsquxt5t.life

cpjeg06jqj7.life

tuaksrh3m4v.life

pnkk456mk55.life

bryfg80da8m.life

4c9takty1zx.life

17afrof66rf.life

keoauupcj2n.life

okxar0c3d29.life

759lhww6ixh.life

br40ztd8bya.life

vdug3t5r2cz.life

6j0uqybrqj4.life

km87l2nqldk.life

d421obfpnmh.life

hsk3pjutatd.life

iudmgiv2ndb.life

vf9bknmns0b.life

325g1cipn4m.life

g3z3h2xzdfv.life

i4hmyqc1p69.life

r967duebyji.life

f83jeqe01vd.life

sbprbiukvhf.life

lc2q21q7nd4.life

co7hu2019oy.life

ue9panfagh0.life

fby66hp7jm0.life

njg6qfp2lfa.life

mb1hy4vi0q7.life

7jemrghylwb.life

yxz60ai05jv.life

v68i3v975xq.life

67xsof7l8ak.life

q886dsegew3.life

16nqnk7hvgs.life

we5x2dfevhn.life

88kwlc3k73o.life

p2xo397h86f.life

njljnzf5c20.life

2g6py8d93tm.life

dz8bw5q6jy2.life

gflfug3a9lb.life

rssaelatar7.life

35l9tvici4l.life

lqhjkq5lfiu.life

3t3qouhmhww.life

fuwisezq1sl.life

ibm2bld58ah.life

h02pknjmc6v.life

enenfxgn3fh.life

zcf8nrpzrqk.life
dga_seed_string
TEST_SEE
domain_length
11
num_dga_domains
100
port
443
tld
.life

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpqn9rlct0

File Explorer

tmpqn9rlct0

.exe 1024KB

tmpqn9rlct0

IMPHASH 0e7d77b31705b90280a066941e785013
SHA256 4fb42588606a6c65ed3c47fc1d41ed981b42aea1e82ef69717c06f7db9a769f6
MD5 37f89d4daabbe2c25760d0b630673529
SHA1 11c7b8163c10493593ad725affccb62759b8477c
SHA512 763da367ac32ad0053d32aed74460a34ca1798b2e1f4ec106be9ac805a86c0fba2744a077babd3ec3bffbe97e80ad446af4cbde6873a00d06d7464c8e6346668
SSDEEP 24576:tAZBB0pE2CwPwsqqSUZ57pBloBph3xbjrYWw:pecDqqSOvloBPZj03
TLSH
T10B258D19AEA881E5D077C07889B5A557FBB1B85A5B348BDF0390461E3F736E04E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

359724

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shlwapi

PathCombineW StrCmpIW PathFindFileNameW PathRemoveExtensionW StrStrIW

kernel32

GetModuleFileNameA CreateEventW AreFileApisANSI ReadFile SetHandleInformation SetWaitableTimer TlsSetValue CreateNamedPipeA SetLastError EnterCriticalSection WriteFile TerminateProcess WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection GetQueuedCompletionStatus GetCurrentThreadId GetSystemDirectoryW PostQueuedCompletionStatus MultiByteToWideChar FormatMessageW GetLastError CreateFileA SetEvent TerminateThread TlsAlloc QueueUserAPC LocalFree DeleteCriticalSection VerSetConditionMask WideCharToMultiByte GetEnvironmentStrings SleepEx VerifyVersionInfoW TlsGetValue CreateProcessA TlsFree FormatMessageA CreateIoCompletionPort FreeEnvironmentStringsA GetExitCodeProcess GetProcAddress GetModuleHandleW Sleep GetCurrentProcess Thread32Next Thread32First GetModuleHandleA LoadLibraryA VirtualProtectEx OpenThread HeapFree lstrlenA CreateFileW HeapReAlloc HeapAlloc GetProcessHeap GetModuleFileNameW SetFilePointer lstrcmpA GetFileAttributesA Wow64DisableWow64FsRedirection ExpandEnvironmentStringsW Wow64RevertWow64FsRedirection GetWindowsDirectoryW GetCurrentDirectoryW GlobalMemoryStatusEx GetFileAttributesW GetStdHandle QueryPerformanceFrequency QueryPerformanceCounter RaiseException HeapSize WriteConsoleW WaitForSingleObject CloseHandle Process32FirstW Process32NextW CreateToolhelp32Snapshot GetCurrentProcessId CopyFileA lstrcatA FindClose SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW DecodePointer GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileA EncodePointer RtlPcToFileHeader CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind OpenProcess FindFirstFileExA GetTimeZoneInformation GetOEMCP IsValidCodePage SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType ExitProcess GetACP GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime

user32

GetCursorPos FindWindowW

advapi32

RegQueryValueExW CryptGenRandom CryptReleaseContext CryptAcquireContextW GetUserNameW CloseServiceHandle OpenSCManagerW EnumServicesStatusExW RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegOpenKeyExW LookupPrivilegeValueW

shell32

SHGetSpecialFolderPathA SHGetSpecialFolderPathW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoInitializeSecurity CoUninitialize

oleaut32

SafeArrayGetUBound SafeArrayGetElement SafeArrayGetLBound SafeArrayUnaccessData SafeArrayAccessData SysFreeString SysAllocString VariantClear VariantInit

mpr

WNetGetProviderNameW

iphlpapi

GetAdaptersInfo

wtsapi32

WTSEnumerateProcessesA WTSFreeMemory

ws2_32

htons inet_addr inet_ntop closesocket recv send setsockopt WSAGetLastError connect socket WSAStartup getsockname getaddrinfo freeaddrinfo WSACleanup

rpcrt4

RpcServerRegisterIfEx RpcMgmtStopServerListening RpcServerListen NdrServerCall2 RpcBindingFree RpcServerUnregisterIf RpcServerUseProtseqEpA

Name

.text

Size

632KB

Virtual Size

631KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

275KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

74KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=13, id=241, version=40116,

count=160, id=243, version=40116,

count=25, id=242, version=40116,

count=30, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=10, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=8, id=259, version=24123,

count=65, id=261, version=24123,

count=39, id=260, version=24123,

count=1, id=206, version=65501,

count=3, id=208, version=65501,

count=1, id=259, productName=VS2015 UPD3 build 24210, version=24210,

count=3, productName=Unmarked objects (old),

count=29, id=203, version=65501,

count=275, id=1, productName=Unmarked objects,

count=58, id=265, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,