Overview

overview

10

Static

static

3

tmplr_60vxs.msi

windows10-ltsc_2021-x64

10

tmplr_60vxs.msi

windows10-2004-x64

10

tmplr_60vxs.msi

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    09/06/2026, 00:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmplr_60vxs.msi
  • Size 2.7MB
  • Sample260609-a74v6ah16w
  • SHA256 1164b944f47a9701ddd682f59c60425faed350647e3f9e562e1abc140a89c7f2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
138704discoverybumblebeeloaderpersistenceprivilege_escalationransomwareupx

Malware Config

Extracted

Family

  • bumblebee

Botnet

  • 138704

Attributes
  • dga

    45urhm0ldgxb.live

    gx6xly9rp6vl.live

    zv46ga4ntybq.live

    7n1hfolmrnbl.live

    vivh2xlt9i6q.live

    97t3nh4kk510.live

    kbkdtwucfl40.live

    qk6a1ahb63uz.live

    whko7loy7h5z.live

    dad1zg44n0bn.live

    7xwz4hw8dts9.live

    ovekd5n3gklq.live

    amwnef8mjo4v.live

    e7ivqfhnss0x.live

    rjql4nicl6bg.live

    4mo318kk29i4.live

    zpo18lm8vg1x.live

    jc51pt290y0n.live

    rg26t2dc4hf4.live

    qw9a58vunuja.live

    ugm94zjzl5nl.live

    mckag832orba.live

    pdw0v9voxlxr.live

    m4tx2apfmoxo.live

    n2uc737ef71m.live

    hkk3112645hz.live

    ugko9g5ipa4o.live

    8wgq2x4dybx9.live

    h81fx7sj8srr.live

    a4tgoqi1cm8x.live

  • dga_seed

    7834006444057268685

  • domain_length

    12

  • num_dga_domains

    300

  • port

    443

  • tld

    .live

rc4.plain

Signatures

  • Family: BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Badlisted process makes network request 25 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmplr_60vxs.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2296
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3624
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:5744
      • C:\Windows\system32\rundll32.exe
        "rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\qpgEZsswIP.dll",DllRegisterServer
        2⤵
        • Badlisted process makes network request
        • Loads dropped DLL
        PID:5644
      • C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\Reader_Install_Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\Reader_Install_Setup.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:4696
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2672

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5822b7.rbs
          • Path C:\Config.Msi\e5822b7.rbs
          • Size 8KB
          • SHA256 dfc8199af6acf80d84bb29405c7def791e368ba7749d7f5915a9ffa43773c038
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Reader_Install_Setup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\Reader_Install_Setup.exe
          • Size 1.4MB
          • SHA256 ac6311039d5bfe719198c15577d3ee870185529f9510f5c0ddc066f1c8d8c462
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qpgEZsswIP.dll
          • Path C:\Users\Admin\AppData\Local\Temp\Package Installation Dir\qpgEZsswIP.dll
          • Size 2.3MB
          • SHA256 2cb0aea0f3dfe49b99f5f7a0e6f6020413c916e4a21d05d2df1cca3de3e7e91d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5822b6.msi
          • Path C:\Windows\Installer\e5822b6.msi
          • Size 2.7MB
          • SHA256 1164b944f47a9701ddd682f59c60425faed350647e3f9e562e1abc140a89c7f2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.6MB
          • SHA256 d8a1308a8a8d1107eee1164351030ad5d1009220a30b5730676a4873cc0bd984
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {9cfc1732-f6b4-49a0-ba5b-5db5de7a7e9e}_OnDiskSnapshotProp
          • Path \??\Volume{f71a51ab-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{9cfc1732-f6b4-49a0-ba5b-5db5de7a7e9e}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 f3f4591140ac16246634cefcad8f5e54683dcdabd57156f3b0436bbb61aeca9e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4696-15-0x0000000000900000-0x0000000000D45000-memory.dmp
          Download

          memory/4696-35-0x0000000000900000-0x0000000000D45000-memory.dmp
          Download

          memory/4696-100-0x0000000000900000-0x0000000000D45000-memory.dmp
          Download

          memory/4696-101-0x0000000000900000-0x0000000000D45000-memory.dmp
          Download

          memory/4696-103-0x0000000000900000-0x0000000000D45000-memory.dmp
          Download

          memory/5644-30-0x00000150227A0000-0x00000150229BE000-memory.dmp
          Download

          memory/5644-31-0x00000150227A0000-0x00000150229BE000-memory.dmp
          Download

          memory/5644-32-0x00000150227A0000-0x00000150229BE000-memory.dmp
          Download