Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/06/2026, 01:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmpf15ab4b4.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpf15ab4b4.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpf15ab4b4.msi
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target tmpf15ab4b4.msi
- Size 4.1MB
- Sample260602-cbk5aaa14y
- SHA256 d1cabe0d6a2f3cef5da04e35220e2431ef627470dd2801b4ed22a8ed9a918768
- MD5 2ec8daabd77e0dd693fb239bee7a5db6
- SHA1 34d9980c119447884f063b7537e3fa8cfb5d6d2b
- SHA512 eeb1ca977253dc74689a9bd868aaecf26a33be4cd833e8216846528a326b6ed03c5d69109cce93e136183de599f43f45da5bdddebe466a8674dc4d0ea23d69ff
- SSDEEP 98304:kkufF+tKR3Wl0cb6p+4xzGB1PCUzYhtolmRUSQq:kkdtd5l4xzGzPtUnUK
- TLSH T128160127B6DBC622C26D027BF529FE0E1938BE67077041E776E43D5E6870CC16279A12
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bumblebee
Botnet
-
msi
Attributes
-
dga
tvx1ovdepj8.life
acgr6r8zdot.life
ilofx941igp.life
8x2apo5m7ri.life
x9yrzer0ndt.life
93j4v4jopzd.life
ameagxzo2f7.life
nyy41uibsv5.life
ru4jvijdytq.life
l9t6r0y6cvi.life
f4vb9n3tdvh.life
9do3mcejztt.life
pxu1ajsdhqr.life
7exy2b231n2.life
vu5b47m18jn.life
6mnudp7zj73.life
p5047yjrb8q.life
d0xtxp89bb9.life
ygo9u1fkwux.life
fig3gj0v6qe.life
38f5wvwwn7o.life
txgogs9p8a1.life
uyn0icgx1kv.life
2z1ls31az7s.life
0cc2z8zrnhf.life
fsr2hskx44p.life
du19ek78tjw.life
234ct3lkozp.life
he8fq4k8d3w.life
7ewh8ltr7il.life
dw34kmgfl7t.life
f2j20ayqh8y.life
331k2rdkmmb.life
37z6li6l9y2.life
dpgs2lt1sbz.life
plll0xq4y82.life
bzc9sq2pz53.life
7r8ln1wswth.life
y9neib92f2m.life
m5iukps17y7.life
xo8be64ejh2.life
widn8soih8u.life
08mkuqnx6gv.life
lzeqr3apopn.life
o4m5a5no7e8.life
2u8znzsbrto.life
dxyob8x456a.life
lrugnff8fkc.life
38i6lh0rpze.life
mjb3r6mcs1f.life
vl41cymzzfq.life
qc4mwjiop45.life
z3z4fq0420z.life
0tab35o0swu.life
4izk0gc9is6.life
6brdh3p893b.life
736d0mvetjw.life
drmk5rdefb5.life
1v0xhie4os8.life
khxcp22s3dz.life
8z9m8hndrhp.life
xeoz1f1vjs0.life
lobavyclh8e.life
in4pzu7t2pv.life
j280b59doxz.life
6q894zusd4k.life
y7pzxau0717.life
bev8ymaajb7.life
glux8x5b8d6.life
yan95akxgqt.life
9qiliikd3sp.life
ge0lpqif3ar.life
ar7xakeve0o.life
eb4l6wisq9z.life
1grovn87c8s.life
wdga570b8pz.life
nzs8vi9w5o8.life
q7dfpyyhe08.life
exueqqmz3ia.life
65r8nx12fqr.life
vauy5ah65sx.life
8hjv8mbhrlj.life
eeqwg3mzq07.life
b1h0uaabzyz.life
8qvt5iabz5n.life
8ru044xed25.life
w8ligr695sd.life
3e6rrifr5fn.life
9f6p9g7x13s.life
ibcm5at6qrz.life
spd22scperm.life
4k59ij2ujeu.life
07zxfo0kere.life
nhdeapyfg7e.life
y0zvqpi42no.life
zdf5ki8x9r0.life
8mgj12azbyd.life
l6syolvczan.life
mk7plk9c6i2.life
hudrx8fn980.life
-
dga_seed
1016365528594956469
-
domain_length
11
-
num_dga_domains
100
-
port
443
-
tld
.life
rc4.plain
Signatures
- Loads dropped DLL 11 IoCs
pid Process 2160 MsiExec.exe 2160 MsiExec.exe 2160 MsiExec.exe 2160 MsiExec.exe 2160 MsiExec.exe 2160 MsiExec.exe 2160 MsiExec.exe 1616 MsiExec.exe 1616 MsiExec.exe 1616 MsiExec.exe 3920 MsiExec.exe - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 44 3920 MsiExec.exe 48 3920 MsiExec.exe 51 3920 MsiExec.exe 61 3920 MsiExec.exe 95 3920 MsiExec.exe 110 3920 MsiExec.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\K: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\e58da3e.msi msiexec.exe File opened for modification C:\Windows\Installer\e58da3e.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIDABB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDBE6.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{4940F33E-F184-4E77-BB3B-CE26AC9D6D5A} msiexec.exe File opened for modification C:\Windows\Installer\MSIDBD5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDDAC.tmp msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2544 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1400 msiexec.exe 1400 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2544 msiexec.exe Token: SeIncreaseQuotaPrivilege 2544 msiexec.exe Token: SeSecurityPrivilege 1400 msiexec.exe Token: SeCreateTokenPrivilege 2544 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2544 msiexec.exe Token: SeLockMemoryPrivilege 2544 msiexec.exe Token: SeIncreaseQuotaPrivilege 2544 msiexec.exe Token: SeMachineAccountPrivilege 2544 msiexec.exe Token: SeTcbPrivilege 2544 msiexec.exe Token: SeSecurityPrivilege 2544 msiexec.exe Token: SeTakeOwnershipPrivilege 2544 msiexec.exe Token: SeLoadDriverPrivilege 2544 msiexec.exe Token: SeSystemProfilePrivilege 2544 msiexec.exe Token: SeSystemtimePrivilege 2544 msiexec.exe Token: SeProfSingleProcessPrivilege 2544 msiexec.exe Token: SeIncBasePriorityPrivilege 2544 msiexec.exe Token: SeCreatePagefilePrivilege 2544 msiexec.exe Token: SeCreatePermanentPrivilege 2544 msiexec.exe Token: SeBackupPrivilege 2544 msiexec.exe Token: SeRestorePrivilege 2544 msiexec.exe Token: SeShutdownPrivilege 2544 msiexec.exe Token: SeDebugPrivilege 2544 msiexec.exe Token: SeAuditPrivilege 2544 msiexec.exe Token: SeSystemEnvironmentPrivilege 2544 msiexec.exe Token: SeChangeNotifyPrivilege 2544 msiexec.exe Token: SeRemoteShutdownPrivilege 2544 msiexec.exe Token: SeUndockPrivilege 2544 msiexec.exe Token: SeSyncAgentPrivilege 2544 msiexec.exe Token: SeEnableDelegationPrivilege 2544 msiexec.exe Token: SeManageVolumePrivilege 2544 msiexec.exe Token: SeImpersonatePrivilege 2544 msiexec.exe Token: SeCreateGlobalPrivilege 2544 msiexec.exe Token: SeCreateTokenPrivilege 2544 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2544 msiexec.exe Token: SeLockMemoryPrivilege 2544 msiexec.exe Token: SeIncreaseQuotaPrivilege 2544 msiexec.exe Token: SeMachineAccountPrivilege 2544 msiexec.exe Token: SeTcbPrivilege 2544 msiexec.exe Token: SeSecurityPrivilege 2544 msiexec.exe Token: SeTakeOwnershipPrivilege 2544 msiexec.exe Token: SeLoadDriverPrivilege 2544 msiexec.exe Token: SeSystemProfilePrivilege 2544 msiexec.exe Token: SeSystemtimePrivilege 2544 msiexec.exe Token: SeProfSingleProcessPrivilege 2544 msiexec.exe Token: SeIncBasePriorityPrivilege 2544 msiexec.exe Token: SeCreatePagefilePrivilege 2544 msiexec.exe Token: SeCreatePermanentPrivilege 2544 msiexec.exe Token: SeBackupPrivilege 2544 msiexec.exe Token: SeRestorePrivilege 2544 msiexec.exe Token: SeShutdownPrivilege 2544 msiexec.exe Token: SeDebugPrivilege 2544 msiexec.exe Token: SeAuditPrivilege 2544 msiexec.exe Token: SeSystemEnvironmentPrivilege 2544 msiexec.exe Token: SeChangeNotifyPrivilege 2544 msiexec.exe Token: SeRemoteShutdownPrivilege 2544 msiexec.exe Token: SeUndockPrivilege 2544 msiexec.exe Token: SeSyncAgentPrivilege 2544 msiexec.exe Token: SeEnableDelegationPrivilege 2544 msiexec.exe Token: SeManageVolumePrivilege 2544 msiexec.exe Token: SeImpersonatePrivilege 2544 msiexec.exe Token: SeCreateGlobalPrivilege 2544 msiexec.exe Token: SeCreateTokenPrivilege 2544 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2544 msiexec.exe Token: SeLockMemoryPrivilege 2544 msiexec.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2544 msiexec.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1400 wrote to memory of 2160 1400 msiexec.exe 90 PID 1400 wrote to memory of 4112 1400 msiexec.exe 107 PID 1400 wrote to memory of 1616 1400 msiexec.exe 109 PID 1400 wrote to memory of 3920 1400 msiexec.exe 110 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpf15ab4b4.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2544
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 38AF8FC845D5D77C7952699AADFAF0AB C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2160
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4112
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BCBC0F19066A1054EBA10941E60C7EEE2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1616
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Users\Admin\AppData\Roaming\hgdgrgfygXF.dll"2⤵
- Loads dropped DLL
- Badlisted process makes network request
PID:3920
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSI4B6C.tmp
- Size 816KB
- SHA256 8d633efeda1249356b11bf8f46583242356e4f903056b53bd25a99511d1790a1
- MD5 aa88d8f40a286b6d40de0f3abc836cfa
- SHA1 c24eab9e4b10b159b589f4c3b64ef3db111ea1c8
- SHA512 6c2f2f6a2d66015f30158962d653e381136f0f30023380a0ce95bd0944d856113fbde65db52dbb3b5de1c0e2edf2cd53184e721c64b916834be4198c61224519
- SSDEEP 12288:3nre4I5heqAlr0TQG21EX4Ttph0lhSMXleTueml5P96jJtvU0:3ryDzAlr0ufTPh0lhSMXl0uN58NtvU0
- TLSH T116056D3339AAC126E37E05B02A3EDA5B693E7A650BB144CB53D41E2E2570DC26735F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\hgdgrgfygXF.dll
- Size 3.0MB
- SHA256 39f609e59d6bbb9e705ae430de6eb6e92cee2e722d74f4369cc6ff7c601809a7
- MD5 0bbcf2a86a4f752d216029682ccc0616
- SHA1 4016ec20c14c11d597b0f023e2ba3f865037a551
- SHA512 e35495e3a8ed1b875ff7543501ef98f2ecd95f8422cd23187e2153ed1cef66498eadcfb5c4b418fafd696198d5f1763d433945dd5c160a5e617291757ea39319
- SSDEEP 49152:8R5rI3FRrQ2JTqyg+0uh4GShaPYHS5aDfJ8AHDPmoy7vKOsXPaaUJ:8RVI3FpQqTqyg+0ux1MfJzHDOoy7vKTG
- TLSH T142E512E786B0270AD4B9EF79928F00792438E9892E421E97F34C863DAC57350F6D671D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 dedd1b8a81142dcf5af368e5ea7c07cd7fdb0aaf77d0623213778938abccc851
- MD5 f04ac67ce413a30210189f3253139e8f
- SHA1 22721809181e1bc521eee0778f305f1b0e9a2588
- SHA512 9aa5bb3be4fec30a8c5881d396eb6d4b140fef9609ec3a6feb6648df1dfce8ad37f6774a95afd2ffeb12a7100b09cdf83168ae0f2ab4dec604d67923e03f5775
- SSDEEP 24576:zu8m+1zLdoO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:D
- TLSH T1BC47D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f1b600d5-3f90-496a-9896-ba47e69bb675}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c317a67e4bf74c679ffb23860bc9d942097ac29037da439960007d58827b034b
- MD5 0f1e10fbf3da494dd1f9fd482c1189f7
- SHA1 148e4aca3940f2f065585c2c2a9c26f62e83b8d0
- SHA512 6b9359a14265eb7eaf88e455584f2ca3c70242374bb6178a5ad6cad0cae47333c9c09571dffb0be2bc733664a600f110e857a2f4a49a6d3c1d6b5104dc28d632
- SSDEEP 96:Fqg8hdYyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:t4CIb++ZVmN
- TLSH T1B4D188085AE54711E2B3AB3229F18557A877B911EF33CB8E0198238E2670910F875F9F
- MD5 SHA1 SHA512 SSDEEP TLSH