bumblebee | 02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/06/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpg0pnrbvv.msi
Size 3.4MB
Sample260609-bbs98aav7p
SHA256 02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f
MD5 704dc6051ef3851b218c098541823ad0
SHA1 de9ac17fc24f49f1449935f19a532b73efbc44c1
SHA512 2ea6fa292785bc15f3b4315ab018aa08d04082dec37e753840716887c1b92e90cd59bb258dd154c430a1485e827ead75acd97dd68b7fdff08918ec9653546823
SSDEEP 49152:8UbQJAZHOnBIJKR35mSLRG90srYWVBHRkf1Em6b7s95yT241J+k4i8k1j7surg:8U8uEL5mSLRW0sZHRYakoT24ST5kZgH
TLSH
T125F53382E6CC0F3AD68BC731475FC9849938DD94EA990350261E72EC6B773913B78897
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

grp0004 bumblebee loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

grp0004

Attributes

dga
19ak90ckxyjxc.life

o2u1xbm9xoq4p.life

9b10t4vyvx6b5.life

9nl2a1qma4swd.life

gc9fctjq62t2e.life

apsgw881ol7rs.life

rmqa3jodwcmgd.life

85ur7zivhczam.life

evzftxl2qjfj4.life

cp2br7osw928r.life

lhunevjdxw5kz.life

jbrprj8im7aia.life

rdg0u5n7237r5.life

xwn7sukhzhbqv.life

8vh7uizstjhnb.life

u8karkeeu2qtj.life

j34duklow92k3.life

8sg769rvpe1lp.life

inkja7hekgcuv.life

r4a4n001s7uhi.life

r976ptnxbh52l.life

tv9jc206cpnyd.life

xf30997j6tp8z.life

nl2jkkuqs8efp.life

5395dg0j4h79n.life

v30ty639krk3p.life

oknzqkp6ph302.life

rlq13ng659buz.life

ey9n44bwtmjaw.life

trtiqjiry7k05.life

9vgvnzk51j1sy.life

wi88w99xo9zlt.life

hoieva2gl9tzx.life

7oo4hxt5haih5.life

ey8axyn00x8sf.life

kks80hyrpbmuz.life

zom3rkt078g1k.life

n2cy5wx4nfs8n.life

qnw1tsg4ogxa0.life

84ntpl4mk4cwm.life

m5f2awao92hp9.life

nq0tsip71ecq5.life

ithg3ysseil61.life

mvp5pt36h20vf.life

51415jvbttwu4.life

l0ecv85wptocs.life

nuq0isjlua30l.life

wd7jo4d8zlxg0.life

2885patz8ovcf.life

1zwze7b6jqovz.life

s23kd323qzj2l.life

4me127ppi31at.life

eifir9x2xpqsb.life

4hlnzokni29fh.life

ykv99faqy3ky4.life

bgiphdk30zk35.life

8n3rj69ohv8rv.life

29e8eji42sktd.life

bqlbyaavprz19.life

qj2suuu4ixgvf.life

b2ys2fltibnfu.life

z0lg8lijtw3mh.life

p3arx0taom00w.life

gquyy1qf8ncn7.life

ref18bh4aku24.life

epqykfhm5zq6l.life

zw96t31o1h768.life

c45ze0b5hhvdg.life

6kjpjs3v34hbf.life

qhyut7e0tjz2a.life

5p9udlfi4yvg6.life

5ew1715l4z3ef.life

xfi23ljskvgtg.life

ofvs2a3nhyrqi.life

7o3zfbd5rf5mz.life

flewo6le618h7.life

r7rw9inm558jg.life

7qjjcy6vg835x.life

8sz83ieffpzwj.life

0eftob9vxa877.life

0j62jm3djgxe7.life

v2vijxyqbqsbl.life

vuu79f2ne8xl1.life

ew3crbjgfbbhd.life

lqhhfpiqp5chx.life

f3be5ccj5ioc7.life

1ngmbwokqkiov.life

nh0hujf2w5xi9.life

daxbkb16ebdao.life

m4ivqiz0weqy7.life

0ei4jxf0cszgd.life

54zgxvq8jzq81.life

tesc2obtfbdke.life

w1nd36e506qqi.life

fc4v5wx4p4syq.life

43wubiwvmajs3.life

4w1b7rsnyg3sm.life

h8gw0cbhkkrrf.life

k2yu4bhadklet.life

wqfvb1lom02cg.life
dga_seed
7941704092191845612
domain_length
13
num_dga_domains
300
port
443
tld
.life

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Executes dropped EXE 2 IoCs

pid	Process
4492	WinMTR.exe
4128	icardagt.exe

Loads dropped DLL 1 IoCs

pid	Process
4128	icardagt.exe

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2404	msiexec.exe
6	2404	msiexec.exe
8	2404	msiexec.exe
40	2404	msiexec.exe
41	2404	msiexec.exe
44	2404	msiexec.exe
50	2404	msiexec.exe
58	2404	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7CD.tmp	msiexec.exe
File created	C:\Windows\Installer\e58d6f2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58d6f2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e58d6f4.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2404	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000306421734df6c2060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000306421730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090030642173000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a30642173000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d30642173000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\Config\PingSize = "64"	WinMTR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\Config\MaxLRU = "128"	WinMTR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\WinMTR\LRU	WinMTR.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	WinMTR.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\License = "GPL - GNU Public License"	WinMTR.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\HomePage = "http://WinMTR.sourceforge.net"	WinMTR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\Config\Interval = "1000"	WinMTR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\LRU\NrLRU = "0"	WinMTR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\WinMTR	WinMTR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\Config\UseDNS = "1"	WinMTR.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\Version = "0.9"	WinMTR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\WinMTR\Config	WinMTR.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmpg0pnrbvv.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "WinMTR"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "B9FD19FED9B129D44B4DC3C2BC94E164"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4748	msiexec.exe
4748	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2404	msiexec.exe
Token: SeSecurityPrivilege	4748	msiexec.exe
Token: SeCreateTokenPrivilege	2404	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2404	msiexec.exe
Token: SeLockMemoryPrivilege	2404	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2404	msiexec.exe
Token: SeMachineAccountPrivilege	2404	msiexec.exe
Token: SeTcbPrivilege	2404	msiexec.exe
Token: SeSecurityPrivilege	2404	msiexec.exe
Token: SeTakeOwnershipPrivilege	2404	msiexec.exe
Token: SeLoadDriverPrivilege	2404	msiexec.exe
Token: SeSystemProfilePrivilege	2404	msiexec.exe
Token: SeSystemtimePrivilege	2404	msiexec.exe
Token: SeProfSingleProcessPrivilege	2404	msiexec.exe
Token: SeIncBasePriorityPrivilege	2404	msiexec.exe
Token: SeCreatePagefilePrivilege	2404	msiexec.exe
Token: SeCreatePermanentPrivilege	2404	msiexec.exe
Token: SeBackupPrivilege	2404	msiexec.exe
Token: SeRestorePrivilege	2404	msiexec.exe
Token: SeShutdownPrivilege	2404	msiexec.exe
Token: SeDebugPrivilege	2404	msiexec.exe
Token: SeAuditPrivilege	2404	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2404	msiexec.exe
Token: SeChangeNotifyPrivilege	2404	msiexec.exe
Token: SeRemoteShutdownPrivilege	2404	msiexec.exe
Token: SeUndockPrivilege	2404	msiexec.exe
Token: SeSyncAgentPrivilege	2404	msiexec.exe
Token: SeEnableDelegationPrivilege	2404	msiexec.exe
Token: SeManageVolumePrivilege	2404	msiexec.exe
Token: SeImpersonatePrivilege	2404	msiexec.exe
Token: SeCreateGlobalPrivilege	2404	msiexec.exe
Token: SeBackupPrivilege	3704	vssvc.exe
Token: SeRestorePrivilege	3704	vssvc.exe
Token: SeAuditPrivilege	3704	vssvc.exe
Token: SeBackupPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe
Token: SeTakeOwnershipPrivilege	4748	msiexec.exe
Token: SeRestorePrivilege	4748	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2404	msiexec.exe
2404	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4492	WinMTR.exe
4492	WinMTR.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 384	4748	msiexec.exe	106
PID 4748 wrote to memory of 4492	4748	msiexec.exe	108
PID 4748 wrote to memory of 4128	4748	msiexec.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpg0pnrbvv.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2404

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:384
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WinMTR.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WinMTR.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:4492
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4128

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58d6f3.rbs

Path C:\Config.Msi\e58d6f3.rbs
Size 7KB
SHA256 8867e5ebf443d25fb15affd18bd2dfabc231d53d72d49e40bbd6e76ed7fc2c82
MD5 01aaed342d06838f1b8303d84400f113
SHA1 502173bcba647b1646fb8602d4d529e8ffd3a040
SHA512 84b8afdf68221a543f106019f927e84915d744003542ed43163c44b633a559a8b495f366b3b423a0f427d6308253a5ada691166c95f513833124816d1bec6b3b
SSDEEP 96:0m1KJbJ6JEUKUwp8Ze+SMaUCrjKnTCsTlqUCrjKnTCWd/XTlr/A5UhZWXuLsCMp1:R4JtEI8ZeuttOIbtO+ukZ7Mp1
TLSH
T10FF13241B31081E2EC92573ACB0B175A37B3D3DDD6D0230F09CD92685E527C95FE628A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 972e428c144b832ee495097b5de6d23fccf63d85ecb5726e7f4868570d6b9c9b
MD5 7045dffcdab1f570a45ad10afac7c276
SHA1 3facc9c3a3216babd747531f83f9bd37a63f907f
SHA512 8fc2deeb696ebaeb06f1a66328c6063176774a7878fd006817c16e797b4fe61e456531cc8a0c3ef370c0e592fc44764216d94a741b0ce569173a2a9a69ad4761
TLSH
T19F31FA236F2C68308E524DB02AD9EE7219B0C5D52CEB606A7118D91718C1BF69F5554B
MD5 SHA1 SHA512 TLSH

Submit Download

A90AB99B5CC057007BC33B2303FE2710

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A90AB99B5CC057007BC33B2303FE2710
Size 36KB
SHA256 d9d5cd1b0409f032f30ffbae8f5fe1c0b317aa89e389dcd87857f80a388bc5dc
MD5 569f125175b0c5c2d8c8eadaf9d0fd22
SHA1 13be81b87279ed3d001e47124870493835040122
SHA512 7090a54fb88d04f892e1b3c2f6c82def07c8a032066455bba266f0f91f8412096156830fac4ae0451b32f8ebe873dcb552d08651bb4feeee13d02d68a0bfff5d
SSDEEP 768:skuTmM8h4ciFPw+JHofn1Q8mPqecaTEiw79kWM:+TmM86tXsvmPHcaNwBnM
TLSH
T141F2B860BE7C6A70E6CDCE720CADD75BDFA264CA2612571A47649AD078036CFCF36840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 9a7db62a9f361706471b4aea9f6b8bf04e2fddd917f536cab27c43ffb337271f
MD5 3e74e93d4d6a5d3cf0f7e7e12046f591
SHA1 de3f8a059f95da2f27629f87872f9c1af0304ee0
SHA512 e2e92593d3d4186e864305e71fa21553b0163e0df47b9431c3c87ad772f903806035f61683dba042c51961380e334afb3f2572e66a6c1b31cd8fc3a2f79478e9
TLSH
T19BF0DC2405B1533DF177DA790BC9A066AB26F8233C70CF62121A0B4E2D31B009C3352A
MD5 SHA1 SHA512 TLSH

Submit Download

A90AB99B5CC057007BC33B2303FE2710

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A90AB99B5CC057007BC33B2303FE2710
Size 226B
SHA256 2235a6b7dc1decd0e743e90ca425f07a5fd7c872b78ae6600c17ca44f195780e
MD5 d6576cb879d4af077c3c608eab20c5c6
SHA1 ec45e1bf5812d7c847acef0bbf8af378462e5d75
SHA512 a88b217e9b77797dbb5c5fc937df7daa502352639a8c7cebdc86b7e69ebb970da0173b67a904643b334ec8f57f5bded32bc58746c853cfdc2e6c6e4f2ff167b9
TLSH
T1E4D012145B94030EF1619F3A2DE24953DFB1AE128DB6C724017A06445970D408C31E6E
MD5 SHA1 SHA512 TLSH

Submit Download

WinMTR.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WinMTR.exe
Size 2.3MB
SHA256 9ad74a0f18ce39a0d92a9dabc6ef7ebb2aebf1471ed868f14e183faf0123eb87
MD5 7174ccf02161dab6e424e2de83807deb
SHA1 dbaef2cbdd50d56e2d6bbd63991d22391526894b
SHA512 3feb78fc4b60dc089c7c84b31ab3d676458c82d91b3a1c12db469dbb6d56b13a62cb3cfa3e5bd94490a89c659d6d17caff8e1a5060ebb49a81529aeda15e0f5f
SSDEEP 49152:jgUtLamQ9h/eWg7dfN/RODru+USamit26nFd2b3g2:kua9c17dpt26n2b3g
TLSH
T1FBB55B5B22B861F4E0668176C407874BC7F274720B35C3CF50A517AE1FB76B60DAA7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icardagt.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
Size 1.3MB
SHA256 473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
MD5 2fe97a3052e847190a9775431292a3a3
SHA1 43edc451ac97365600391fa4af15476a30423ff6
SHA512 93ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a
SSDEEP 12288:pvRneDBcP5s/UdTEQa8DOmJRJmILwCHEA188KijZZLr0X+c/d2zlNRTSTNo7I8:phe4kRQa8DO6JmJCvrKimZ4zlNRTST38
TLSH
T1D955F969F97C4176E121D4BFD183DA4AD1B230422B305AE74262CF6E1E3F5D6A13A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dll

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\version.dll
Size 2.7MB
SHA256 a09923899b318848d44dc706ccc1d3489a383b9af0921351134d14a152a7925b
MD5 18689fd0311a64a712a313d58fccbbfe
SHA1 c135d29186faa04602d90e96d17aaf58fe16b8f7
SHA512 3a7d0129da9d079f4cf5266b3c70ea950ed852b3573abae9aadd9eab1db68dea330eac5ed23c78426ea1bffd5d75aa416b2d2ce39349bafccea9e429301212e0
SSDEEP 49152:/yCl4fYhi7rch+A0UiepgqALMwajmaPUDiLIscxgyLGURN+y4J:/R/Pge0bLGUS9
TLSH
T1ADD58D0A2B3B4A5ED521C4BD92771223C469BDFCC018B5798DC04B457FA2F60A67A7EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58d6f2.msi

Path C:\Windows\Installer\e58d6f2.msi
Size 3.4MB
SHA256 02197c23af1f99c3fa41d52f7f925e47ae5bfb5e604314d19382b1bb7112463f
MD5 704dc6051ef3851b218c098541823ad0
SHA1 de9ac17fc24f49f1449935f19a532b73efbc44c1
SHA512 2ea6fa292785bc15f3b4315ab018aa08d04082dec37e753840716887c1b92e90cd59bb258dd154c430a1485e827ead75acd97dd68b7fdff08918ec9653546823
SSDEEP 49152:8UbQJAZHOnBIJKR35mSLRG90srYWVBHRkf1Em6b7s95yT241J+k4i8k1j7surg:8U8uEL5mSLRW0sZHRYakoT24ST5kZgH
TLSH
T125F53382E6CC0F3AD68BC731475FC9849938DD94EA990350261E72EC6B773913B78897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 3c9df4db248de8f22dd1fb48ea090930c88d150022e5116ebd666235e834e80b
MD5 e1bfe7d9f8fce65881a21d465073095c
SHA1 271327e1a5524b5540180774a9a8eb0e1eef75ff
SHA512 1f1f8adc7b5aa94fa3a880f0c9656891d45feff64dd13260162d1751990cb7bff5f698344b67ae854cf069ec67fdffc361252f3dc998ec3aedf3bb7b419f6eb9
SSDEEP 24576:0u8m+1z6doO/vvTLbWzuGWKHiakzLlzi/FW9R8iF7kaiu0qOIPlqr1YRG:h
TLSH
T14F47D42832F92210E7F79F3C68F0AA2749397D579C19DE8D45411F4E0921BB1E8B2F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7b7be35d-f117-4141-b70e-d0f0677a2738}_OnDiskSnapshotProp

Path \??\Volume{73216430-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{7b7be35d-f117-4141-b70e-d0f0677a2738}_OnDiskSnapshotProp
Size 6KB
SHA256 b5a24646a9f529f2ae0ac0ecb4d79f2bcdfd4d8090f8ab9e60bf26e7dd5dbc88
MD5 f0f6966f0c96fd8f41677b59a2be276a
SHA1 8951b9f0e77a30b868d85760149c7ffe125ac8b6
SHA512 a89d345690b07d0d7f808f74458f80c58ccedee59481e4d0b0d5d876f6a9708e20bed4cad39e0cec52b7d8fbcf1fd80dc899dbb152123132896a1abbf4f82b85
SSDEEP 96:FaNhdcyvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:wzyIb++ZVm
TLSH
T188D189185AF54311E2B3AB3228F18557A477B911EF33CB8E0198238E6630910F876F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4128-45-0x0000000002F90000-0x00000000036CF000-memory.dmp

Download

memory/4128-49-0x0000000002F90000-0x00000000036CF000-memory.dmp

Download

memory/4128-58-0x0000000002F90000-0x00000000036CF000-memory.dmp

Download