Overview

overview

10

Static

static

1

tmpi3zk183b.msi

windows10-ltsc_2021-x64

10

tmpi3zk183b.msi

windows10-2004-x64

10

tmpi3zk183b.msi

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/06/2026, 00:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmpi3zk183b.msi
  • Size 9.9MB
  • Sample260609-bbfn5aav7k
  • SHA256 783a4034e44f58427a248454ade7ab09c4099414bb0a385ca32d8b263cd21ae4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
grp0004discoverybumblebeeloaderpersistenceprivilege_escalationransomware

Malware Config

Extracted

Family

  • bumblebee

Botnet

  • grp0004

Attributes
  • dga

    19ak90ckxyjxc.life

    o2u1xbm9xoq4p.life

    9b10t4vyvx6b5.life

    9nl2a1qma4swd.life

    gc9fctjq62t2e.life

    apsgw881ol7rs.life

    rmqa3jodwcmgd.life

    85ur7zivhczam.life

    evzftxl2qjfj4.life

    cp2br7osw928r.life

    lhunevjdxw5kz.life

    jbrprj8im7aia.life

    rdg0u5n7237r5.life

    xwn7sukhzhbqv.life

    8vh7uizstjhnb.life

    u8karkeeu2qtj.life

    j34duklow92k3.life

    8sg769rvpe1lp.life

    inkja7hekgcuv.life

    r4a4n001s7uhi.life

    r976ptnxbh52l.life

    tv9jc206cpnyd.life

    xf30997j6tp8z.life

    nl2jkkuqs8efp.life

    5395dg0j4h79n.life

    v30ty639krk3p.life

    oknzqkp6ph302.life

    rlq13ng659buz.life

    ey9n44bwtmjaw.life

    trtiqjiry7k05.life

  • dga_seed

    7941704092191845612

  • domain_length

    13

  • num_dga_domains

    300

  • port

    443

  • tld

    .life

rc4.plain

Signatures

  • Family: BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 32 IoCs
  • Drops file in Windows directory 19 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 18 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpi3zk183b.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3236
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1136
      • C:\Windows\system32\msiexec.exe
        msiexec /i "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\RVTools4.7.1.msi"
        2⤵
        • Enumerates connected drives
        • Suspicious use of FindShellTrayWindow
        PID:4908
      • C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
        "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3212
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 16CBEEF45335B95C7D4EED29228D049D C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:2776
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 9519380E0EDA1F5A9A4D4FC7B82A0922 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4648
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2652

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e58757a.rbs
          • Path C:\Config.Msi\e58757a.rbs
          • Size 7KB
          • SHA256 df838d85c41f5db36a54d38f4f4f55d9a1856181f7845c661eaef6e1a838d812
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e58757d.rbs
          • Path C:\Config.Msi\e58757d.rbs
          • Size 19KB
          • SHA256 eb908fef54f88333472b93c946ba0fad6a28e5323b788b459bfe42199baf22ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
          • Size 1KB
          • SHA256 b4076dea543e21614438cb7eb2ad4c45d06ba1a656349089eefa73247bbc783f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Size 1KB
          • SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
          • Size 536B
          • SHA256 f9737b8f3acd1ccdf915be101ed596844514233c993ed101dd932b79657be6bc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Size 536B
          • SHA256 bf0efdbddce5221bcfcf57f2623c972d8ddf03fea34c9dd02c179f02099a0d90
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RVTools4.7.1.msi
          • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\RVTools4.7.1.msi
          • Size 8.0MB
          • SHA256 0506126bcbc4641d41c138e88d9ea9f10fb65f1eeab3bff90ad25330108b324c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VERSION.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\VERSION.dll
          • Size 2.7MB
          • SHA256 a09923899b318848d44dc706ccc1d3489a383b9af0921351134d14a152a7925b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icardagt.exe
          • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
          • Size 1.3MB
          • SHA256 473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI7867.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI7867.tmp
          • Size 285KB
          • SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e587579.msi
          • Path C:\Windows\Installer\e587579.msi
          • Size 9.9MB
          • SHA256 783a4034e44f58427a248454ade7ab09c4099414bb0a385ca32d8b263cd21ae4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.1MB
          • SHA256 c4bb3160c86ea006dbe4176caf6d64543968febd15def70b00170aa357618366
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {b9a9b83a-98e7-4bdd-b69f-4998a0340aa2}_OnDiskSnapshotProp
          • Path \??\Volume{cd0aa2ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b9a9b83a-98e7-4bdd-b69f-4998a0340aa2}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 94239abb9588e1873043c4fe61d4591ade2d60626663fb722beaf312a8c85d27
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3212-52-0x0000000002F20000-0x000000000365F000-memory.dmp
          Download

          memory/3212-56-0x0000000002F20000-0x000000000365F000-memory.dmp
          Download

          memory/3212-131-0x0000000002F20000-0x000000000365F000-memory.dmp
          Download