Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/05/2026, 13:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmp3v300jh1.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp3v300jh1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target tmp3v300jh1.exe
- Size 6.1MB
- Sample260522-qpg7faex9s
- SHA256 4203f929fe8fab1c990e027216ef732955cc4fbfe598e9dc02dbf61fefd2e579
- MD5 4a657cf9c1289e3df987268e32961a66
- SHA1 77167ba7c7adb768ba4a1a0d561a8828e73f5035
- SHA512 3515c161728c0294b822cfb8a313d85dfb9305e6283f533d20b61894468129012991bec1709e001a8067660668aa6c3a2894273a8f251c3cc15cc0d548a88976
- SSDEEP 98304:QAs++BUHecpbpx+sborjZGS/maM8jwsWjMZd3CuwQ3dm0vZ0QgKuEf:QAKBx4px+sNgHW4H3CkZqEf
- TLSH T1B956AE31724AC43BDA6201B1192C9E9E512C7E750BB264CBB7DC2E7E1BB54C21736E27
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
onkomsi2
Attributes
-
dga
n64c2akw.life
zefawfb0.life
dph3pby8.life
hx0hysyg.life
1qa3k743.life
luw8ubf2.life
rbvsf6io.life
4huoqrsp.life
8qwcvseh.life
37zi55wc.life
i9f44mju.life
aqnx9c9h.life
3nmeg5wa.life
r5ue5rok.life
et53yjoc.life
tvgco82h.life
0xtmu3tz.life
6xhpschv.life
6o26tws0.life
0oz7923s.life
54y2q50j.life
9hh7hq5r.life
r0ca080m.life
43vtghfz.life
qal55els.life
p5e68m36.life
x698iah6.life
kqn0zkig.life
wq6w8jkq.life
i6n08gx7.life
yykdmh0r.life
is45ipqt.life
btycmaq0.life
bei9dppm.life
3jhcm6ou.life
1q04n1r6.life
10ciy2hb.life
11ou1grl.life
83b0leyy.life
t31jn4t1.life
b24f19ne.life
igak9l9s.life
hkgd9kar.life
02uhomlq.life
zpy1vssg.life
j57fzy12.life
zmlly8xo.life
pe6r5tzc.life
cg4cuoyi.life
pyjijjlm.life
m3vc2ce4.life
p1p97dov.life
ep0kbvph.life
0rlxan4o.life
zdx0i18o.life
7kmzys39.life
e97igyz6.life
hjcbhzd8.life
az77sw77.life
d0k4fdaa.life
c9l8ri53.life
ay03u2te.life
t99iv15x.life
6a1fbhay.life
zna5lybe.life
vxyojl27.life
mddoknvi.life
2z2dl1og.life
vojg90l2.life
awr5omre.life
tcjcv520.life
aqjjchti.life
6qwim2j8.life
1p34o0do.life
8hxwl72r.life
wykpnxcx.life
o10qz4xe.life
7564a2mg.life
aiv8bb2b.life
jwyxm0f3.life
4soexc4m.life
3xqy6csn.life
3k8iq1nb.life
w2hje2t7.life
fra3xqrx.life
4r3inwrt.life
qhfoevow.life
a9nhflze.life
jpngew6a.life
baunjh6t.life
yqofro9q.life
uq034w07.life
oq36weoi.life
vv5sfo80.life
0req10rd.life
m4v4xq2f.life
1p24echu.life
ohwv1vpp.life
z2tp7x2v.life
q65io756.life
-
dga_seed_string
anjd78ka
-
domain_length
8
-
num_dga_domains
100
-
port
443
-
tld
.life
rc4.plain
Signatures
- Loads dropped DLL 11 IoCs
pid Process 3948 MsiExec.exe 3948 MsiExec.exe 3948 MsiExec.exe 3948 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 1920 MsiExec.exe 4596 MsiExec.exe 1920 MsiExec.exe - Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 25 2400 msiexec.exe 28 4596 MsiExec.exe 47 4596 MsiExec.exe 61 4596 MsiExec.exe 71 4596 MsiExec.exe 79 4596 MsiExec.exe 89 4596 MsiExec.exe 95 4596 MsiExec.exe 100 4596 MsiExec.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: tmp3v300jh1.exe File opened (read-only) \??\N: tmp3v300jh1.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: tmp3v300jh1.exe File opened (read-only) \??\L: tmp3v300jh1.exe File opened (read-only) \??\T: tmp3v300jh1.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: tmp3v300jh1.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: tmp3v300jh1.exe File opened (read-only) \??\P: tmp3v300jh1.exe File opened (read-only) \??\X: tmp3v300jh1.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: tmp3v300jh1.exe File opened (read-only) \??\Q: tmp3v300jh1.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\R: tmp3v300jh1.exe File opened (read-only) \??\U: tmp3v300jh1.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: tmp3v300jh1.exe File opened (read-only) \??\Z: tmp3v300jh1.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: tmp3v300jh1.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: tmp3v300jh1.exe File opened (read-only) \??\V: tmp3v300jh1.exe File opened (read-only) \??\W: tmp3v300jh1.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: tmp3v300jh1.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: tmp3v300jh1.exe - Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4596 MsiExec.exe - Drops file in Windows directory 14 IoCs
description ioc Process File created C:\Windows\Installer\e584f15.msi msiexec.exe File opened for modification C:\Windows\Installer\e584f15.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4FE0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI506E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI50AD.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI50ED.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI513C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI514D.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI51F9.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{7ABB9196-B644-4E72-A55F-311DFA6B488A} msiexec.exe File opened for modification C:\Windows\Installer\MSI5343.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp3v300jh1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3860 msiexec.exe 3860 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 3860 msiexec.exe Token: SeCreateTokenPrivilege 4332 tmp3v300jh1.exe Token: SeAssignPrimaryTokenPrivilege 4332 tmp3v300jh1.exe Token: SeLockMemoryPrivilege 4332 tmp3v300jh1.exe Token: SeIncreaseQuotaPrivilege 4332 tmp3v300jh1.exe Token: SeMachineAccountPrivilege 4332 tmp3v300jh1.exe Token: SeTcbPrivilege 4332 tmp3v300jh1.exe Token: SeSecurityPrivilege 4332 tmp3v300jh1.exe Token: SeTakeOwnershipPrivilege 4332 tmp3v300jh1.exe Token: SeLoadDriverPrivilege 4332 tmp3v300jh1.exe Token: SeSystemProfilePrivilege 4332 tmp3v300jh1.exe Token: SeSystemtimePrivilege 4332 tmp3v300jh1.exe Token: SeProfSingleProcessPrivilege 4332 tmp3v300jh1.exe Token: SeIncBasePriorityPrivilege 4332 tmp3v300jh1.exe Token: SeCreatePagefilePrivilege 4332 tmp3v300jh1.exe Token: SeCreatePermanentPrivilege 4332 tmp3v300jh1.exe Token: SeBackupPrivilege 4332 tmp3v300jh1.exe Token: SeRestorePrivilege 4332 tmp3v300jh1.exe Token: SeShutdownPrivilege 4332 tmp3v300jh1.exe Token: SeDebugPrivilege 4332 tmp3v300jh1.exe Token: SeAuditPrivilege 4332 tmp3v300jh1.exe Token: SeSystemEnvironmentPrivilege 4332 tmp3v300jh1.exe Token: SeChangeNotifyPrivilege 4332 tmp3v300jh1.exe Token: SeRemoteShutdownPrivilege 4332 tmp3v300jh1.exe Token: SeUndockPrivilege 4332 tmp3v300jh1.exe Token: SeSyncAgentPrivilege 4332 tmp3v300jh1.exe Token: SeEnableDelegationPrivilege 4332 tmp3v300jh1.exe Token: SeManageVolumePrivilege 4332 tmp3v300jh1.exe Token: SeImpersonatePrivilege 4332 tmp3v300jh1.exe Token: SeCreateGlobalPrivilege 4332 tmp3v300jh1.exe Token: SeCreateTokenPrivilege 4332 tmp3v300jh1.exe Token: SeAssignPrimaryTokenPrivilege 4332 tmp3v300jh1.exe Token: SeLockMemoryPrivilege 4332 tmp3v300jh1.exe Token: SeIncreaseQuotaPrivilege 4332 tmp3v300jh1.exe Token: SeMachineAccountPrivilege 4332 tmp3v300jh1.exe Token: SeTcbPrivilege 4332 tmp3v300jh1.exe Token: SeSecurityPrivilege 4332 tmp3v300jh1.exe Token: SeTakeOwnershipPrivilege 4332 tmp3v300jh1.exe Token: SeLoadDriverPrivilege 4332 tmp3v300jh1.exe Token: SeSystemProfilePrivilege 4332 tmp3v300jh1.exe Token: SeSystemtimePrivilege 4332 tmp3v300jh1.exe Token: SeProfSingleProcessPrivilege 4332 tmp3v300jh1.exe Token: SeIncBasePriorityPrivilege 4332 tmp3v300jh1.exe Token: SeCreatePagefilePrivilege 4332 tmp3v300jh1.exe Token: SeCreatePermanentPrivilege 4332 tmp3v300jh1.exe Token: SeBackupPrivilege 4332 tmp3v300jh1.exe Token: SeRestorePrivilege 4332 tmp3v300jh1.exe Token: SeShutdownPrivilege 4332 tmp3v300jh1.exe Token: SeDebugPrivilege 4332 tmp3v300jh1.exe Token: SeAuditPrivilege 4332 tmp3v300jh1.exe Token: SeSystemEnvironmentPrivilege 4332 tmp3v300jh1.exe Token: SeChangeNotifyPrivilege 4332 tmp3v300jh1.exe Token: SeRemoteShutdownPrivilege 4332 tmp3v300jh1.exe Token: SeUndockPrivilege 4332 tmp3v300jh1.exe Token: SeSyncAgentPrivilege 4332 tmp3v300jh1.exe Token: SeEnableDelegationPrivilege 4332 tmp3v300jh1.exe Token: SeManageVolumePrivilege 4332 tmp3v300jh1.exe Token: SeImpersonatePrivilege 4332 tmp3v300jh1.exe Token: SeCreateGlobalPrivilege 4332 tmp3v300jh1.exe Token: SeCreateTokenPrivilege 4332 tmp3v300jh1.exe Token: SeAssignPrimaryTokenPrivilege 4332 tmp3v300jh1.exe Token: SeLockMemoryPrivilege 4332 tmp3v300jh1.exe Token: SeIncreaseQuotaPrivilege 4332 tmp3v300jh1.exe Token: SeMachineAccountPrivilege 4332 tmp3v300jh1.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2400 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3860 wrote to memory of 3948 3860 msiexec.exe 92 PID 4332 wrote to memory of 2400 4332 tmp3v300jh1.exe 93 PID 3860 wrote to memory of 1920 3860 msiexec.exe 94 PID 3860 wrote to memory of 4596 3860 msiexec.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp3v300jh1.exe"C:\Users\Admin\AppData\Local\Temp\tmp3v300jh1.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\security update\security update 1.5.2.3\install\A6B488A\security update.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\tmp3v300jh1.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1779215715 " AI_EUIMSI=""2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:2400
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 3855EAE5911EA0FD168F70196EEC0C71 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3948
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4A5E79BBE64E6264DBA3717F510673762⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1920
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1BC5A90855147AD4CF959641312BF0D22⤵
- Loads dropped DLL
- Badlisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:4596
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e584f18.rbs
- Size 1KB
- SHA256 aeb9a698191ffd834761dab855e90e5d2797050aa71ae6a67d6c7bfb762b1b56
- MD5 bac5fb518af52ebb9c3d59a89cddbe27
- SHA1 fbf29a0c6f0ccb98227a305ff7970c30e3b96507
- SHA512 00578a708d2997fb8a5564bd12f43eb2963909b34148ef0d12dd722a8157c13b46d2b341de161976d2b31297af7c5a46c867241259d08830d58cd875b4374486
- TLSH T18F21204BE38CC3EBD4E4C03A47742E5D685B0A30D602271C6A078108FA0A1AC6FFA0E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI4B2E.tmp
- Size 721KB
- SHA256 52f41817669af7ac55b1516894ee705245c3148f2997fa0e6617e9cc6353e41e
- MD5 5a1f2196056c0a06b79a77ae981c7761
- SHA1 a880ae54395658f129e24732800e207ecd0b5603
- SHA512 9afc180ebc10c0ee0d7306f4b7085608a4e69321044d474691587bf7e63f945888781a9fc5e69568d351ac690b0335214bd04bdf5c75fd8a3bd1ec4be5d3475a
- SSDEEP 6144:NNNRBgD0EottR4BKvUNBHZQCAU9m9d98HyFGsDXTuph0lhSMXlBXBW/n6JTJU5h5:NNbIUOl3HasHowph0lhSMXlesu5eNBAp
- TLSH T1F9F46B203695C03AD66E46B029BCCBAB55697E760B7254CB73C86E3A19F18C39335F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\security update\security update 1.5.2.3\install\A6B488A\security update.msi
- Size 7.8MB
- SHA256 8ae7694001a73e0eebf0ea394396cd1aacc3a817e1e321da288e445f4feb1465
- MD5 cbce77f88d5fd1df590d5172bbb83a2c
- SHA1 65bd87e1c512e9cd60a3952e0712d0f67aa952e1
- SHA512 4d579a70782b99c4fb19398f9d7b430cbe5f9ee5b67dbf360f543fecd010aba373a43266b63b5e7bbe00f8636cdd7d9346806cdaffbaa02608c08310cd752ded
- SSDEEP 196608:jxaEo5JeKKpyRqNJMWb75RGlzGban/ba:joEWJeKKpyRqNJMWb75RGlzGbCba
- TLSH T11C866C21B2C6DD2BC91E9D71152C86FAC06CDD65B76184CBB28C7B2BAB703D30732952
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI513C.tmp
- Size 2.1MB
- SHA256 189046093d0018570c1d9a12ad4aca14d4ccd65fb63d228275fd7067c24d2ecd
- MD5 bedb0f369ebb79dbcf856379ecb6566c
- SHA1 4a8c27c1a2f0be31b73fdad222782648c9ce6b0c
- SHA512 06a3d60bf011453711d2f1df385b28edc3815f6e108567169690821b3085b8fda526a123cfbacb6e42290a0576fa878c41cdebef77609367965df12a159a02ee
- SSDEEP 49152:onP1vdcvQ6fxh8KENpyRqBHffpWiEWh5n7:2o5JeKKpyRqNJMWb7
- TLSH T11EA5262DF9C97FE3DE23A5B3A111455498CCCC4A9B52EB63C191A773B62A33C9C97240
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI51F9.tmp
- Size 838KB
- SHA256 a8dfdc283ad8d4dc6f500ddfab564e79dadae075c0d54784b50e1ca548709b30
- MD5 4a3f6a4023abd6bba56534de47d20017
- SHA1 02dd888e467143e2e35465d73f39cf3e66afad10
- SHA512 580c7918ef90eb0020901bab645b72bcaf945ceb5bd56c2e7847f229b31a961bc4cd4ca9cb2583db480947ca8a0880b5ae4bd26717217abcacc9754352aaba28
- SSDEEP 12288:xsHSZypd9yN+5NDwxf3bNca9RS3MwSLkSCnPuZAQgQph0lhSMXleut5PZU/15fG:xKHoakg3BSASCndmh0lhSMXlJ5PZUdVG
- TLSH T1F9057D31359AC036E66D55B03A3DCEAB917D7B720FF240DBA7C46E6A58708C21632E17
- MD5 SHA1 SHA512 SSDEEP TLSH