Overview

overview

10

Static

static

1

tmpcdhjz3b5.msi

windows10-ltsc_2021-x64

10

tmpcdhjz3b5.msi

windows10-2004-x64

10

tmpcdhjz3b5.msi

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/06/2026, 00:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmpcdhjz3b5.msi
  • Size 34.3MB
  • Sample260609-bbmsfaav7n
  • SHA256 9514b84abed58ad7c02e39020c8847b80975e5d49cea5d33f22c75af3c3db583
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
grp0005discoverybumblebeeloaderpersistenceprivilege_escalationransomware

Malware Config

Extracted

Family

  • bumblebee

Botnet

  • grp0005

Attributes
  • dga

    19ak90ckxyjxc.life

    o2u1xbm9xoq4p.life

    9b10t4vyvx6b5.life

    9nl2a1qma4swd.life

    gc9fctjq62t2e.life

    apsgw881ol7rs.life

    rmqa3jodwcmgd.life

    85ur7zivhczam.life

    evzftxl2qjfj4.life

    cp2br7osw928r.life

    lhunevjdxw5kz.life

    jbrprj8im7aia.life

    rdg0u5n7237r5.life

    xwn7sukhzhbqv.life

    8vh7uizstjhnb.life

    u8karkeeu2qtj.life

    j34duklow92k3.life

    8sg769rvpe1lp.life

    inkja7hekgcuv.life

    r4a4n001s7uhi.life

    r976ptnxbh52l.life

    tv9jc206cpnyd.life

    xf30997j6tp8z.life

    nl2jkkuqs8efp.life

    5395dg0j4h79n.life

    v30ty639krk3p.life

    oknzqkp6ph302.life

    rlq13ng659buz.life

    ey9n44bwtmjaw.life

    trtiqjiry7k05.life

  • dga_seed

    7941704092191845612

  • domain_length

    13

  • num_dga_domains

    300

  • port

    443

  • tld

    .life

rc4.plain

Signatures

  • Family: BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpcdhjz3b5.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:5820
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3888
    • C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\dwm.exe
      "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\dwm.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5056
    • C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\nmap-7.95-setup.exe
      "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\nmap-7.95-setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Users\Admin\AppData\Local\Temp\nssF068.tmp\npcap-1.79.exe
        "C:\Users\Admin\AppData\Local\Temp\nssF068.tmp\npcap-1.79.exe" /loopback_support=no
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5348
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:5392

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e58e7fb.rbs
        • Path C:\Config.Msi\e58e7fb.rbs
        • Size 7KB
        • SHA256 662ba6ed9668de1b0d122007188e3795124d469a10b7af9826b6c15abb47eaa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        357F04AD41BCF5FE18FCB69F60C6680F_A98E62152E5B3955C0691E77FD489F12
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_A98E62152E5B3955C0691E77FD489F12
        • Size 1KB
        • SHA256 879e55b2c52cb2215e00b9bd3cc41e258a09d6570d4df165feacd4021eaf5218
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
        • Size 1KB
        • SHA256 972e428c144b832ee495097b5de6d23fccf63d85ecb5726e7f4868570d6b9c9b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        357F04AD41BCF5FE18FCB69F60C6680F_A98E62152E5B3955C0691E77FD489F12
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_A98E62152E5B3955C0691E77FD489F12
        • Size 536B
        • SHA256 401042d0128f016e0efa66afde918011136759fa2d44eaa640f8a46db15748c2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
        • Size 536B
        • SHA256 e4eb6703a95a97063a9f31ae35ca0125871807becde20b167d5dc34b39e6686e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dwm.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\dwm.exe
        • Size 109KB
        • SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msimg32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\msimg32.dll
        • Size 2.6MB
        • SHA256 5e2382ba5822edc0780c09f58a5a13bc737ac9cc846d89a93a862a64262947ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nmap-7.95-setup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\nmap-7.95-setup.exe
        • Size 32.4MB
        • SHA256 c59b51d15b5965f27db4c5bbd21793ad6b492c8c751836ba8bd43829d791146e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InstallOptions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nssF068.tmp\InstallOptions.dll
        • Size 15KB
        • SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        npcap-1.79.exe
        • Path C:\Users\Admin\AppData\Local\Temp\nssF068.tmp\npcap-1.79.exe
        • Size 1.1MB
        • SHA256 a95577ebbc67fc45b319e2ef3a55f4e9b211fe82ed4cb9d8be6b1a9e2425ce53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InstallOptions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsz335D.tmp\InstallOptions.dll
        • Size 22KB
        • SHA256 61ea114d9d0cd1e884535095aa3527a6c28df55a4ecee733c8c398f50b84cc3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsz335D.tmp\System.dll
        • Size 19KB
        • SHA256 7efe73a8d32ed1b01727ad4579e9eec49c9309f2cb7bf03c8afa80d70242d1c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        options.ini
        • Path C:\Users\Admin\AppData\Local\Temp\nsz335D.tmp\options.ini
        • Size 2KB
        • SHA256 6be0dbd9dae055bf41c260fa807241f5bd64e270978bc1c56ee133a8ace9ea97
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        e58e7fa.msi
        • Path C:\Windows\Installer\e58e7fa.msi
        • Size 34.3MB
        • SHA256 9514b84abed58ad7c02e39020c8847b80975e5d49cea5d33f22c75af3c3db583
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 24.1MB
        • SHA256 48c1860fe8ee9d08e4ada46c89337ea8ad026ebefe8de1f64add13ad4cadcf6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {e7f8ab45-0303-4fc5-97ec-0518be5a29dd}_OnDiskSnapshotProp
        • Path \??\Volume{12d9ef41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e7f8ab45-0303-4fc5-97ec-0518be5a29dd}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 ec24fd7348526635d84a87f4d8128adb52f9755f8258f7797f4b253ef532c38b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5056-62-0x0000000002DF0000-0x000000000352F000-memory.dmp
        Download

        memory/5056-58-0x0000000002DF0000-0x000000000352F000-memory.dmp
        Download

        memory/5056-1046-0x0000000002DF0000-0x000000000352F000-memory.dmp
        Download