Overview

overview

10

Static

static

1

tmp4ln2f0__.msi

windows10-ltsc_2021-x64

10

tmp4ln2f0__.msi

windows10-2004-x64

10

tmp4ln2f0__.msi

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/06/2026, 01:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmp4ln2f0__.msi
  • Size 174.2MB
  • Sample260609-bc434sav8k
  • SHA256 5a847ecc862ee74dd532fefe3a1e01c9f637631692fe74024b7ba15176cd9d13
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
grp0004defense_evasiondiscoverybumblebeeloaderpersistenceprivilege_escalationransomware

Malware Config

Extracted

Family

  • bumblebee

Botnet

  • grp0004

Attributes
  • dga

    19ak90ckxyjxc.life

    o2u1xbm9xoq4p.life

    9b10t4vyvx6b5.life

    9nl2a1qma4swd.life

    gc9fctjq62t2e.life

    apsgw881ol7rs.life

    rmqa3jodwcmgd.life

    85ur7zivhczam.life

    evzftxl2qjfj4.life

    cp2br7osw928r.life

    lhunevjdxw5kz.life

    jbrprj8im7aia.life

    rdg0u5n7237r5.life

    xwn7sukhzhbqv.life

    8vh7uizstjhnb.life

    u8karkeeu2qtj.life

    j34duklow92k3.life

    8sg769rvpe1lp.life

    inkja7hekgcuv.life

    r4a4n001s7uhi.life

    r976ptnxbh52l.life

    tv9jc206cpnyd.life

    xf30997j6tp8z.life

    nl2jkkuqs8efp.life

    5395dg0j4h79n.life

    v30ty639krk3p.life

    oknzqkp6ph302.life

    rlq13ng659buz.life

    ey9n44bwtmjaw.life

    trtiqjiry7k05.life

  • dga_seed

    7941704092191845612

  • domain_length

    13

  • num_dga_domains

    300

  • port

    443

  • tld

    .life

rc4.plain

Signatures

  • Family: BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Badlisted process makes network request 7 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 58 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp4ln2f0__.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:5896
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2488
    • C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
      "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1132
    • C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Wisenet_Device_Manager_v2.9.2_setup_Full.exe
      "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\Wisenet_Device_Manager_v2.9.2_setup_Full.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4108
      • C:\Program Files (x86)\Wisenet\Wisenet Device Manager\Wisenet Device Manager.exe
        "C:\Program Files (x86)\Wisenet\Wisenet Device Manager\Wisenet Device Manager.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3668
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:556
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall delete rule name="Wisenet Device Manager"
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:4492
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:5608
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="Wisenet Device Manager" dir=in action=allow program="C:\Program Files (x86)\Wisenet\Wisenet Device Manager\Wisenet Device Manager.exe" enable=yes
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:3244
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2868

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        2
        T1546

        Installer Packages

        1
        T1546.016

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        2
        T1546

        Installer Packages

        1
        T1546.016

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Impair Defenses

        1
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        System Binary Proxy Execution

        1
        T1218

        Msiexec

        1
        T1218.007

        Credential Access

        Discovery

        Peripheral Device Discovery

        2
        T1120

        Query Registry

        3
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e58ab5f.rbs
        • Path C:\Config.Msi\e58ab5f.rbs
        • Size 7KB
        • SHA256 45201f0c25ab14b1b40a9453adb99cbc9d4c77af1c36d005a76802c59ed09bf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iDMKorean.xml
        • Path C:\Program Files (x86)\Wisenet\Wisenet Device Manager\LangXml\iDMKorean.xml
        • Size 209KB
        • SHA256 ff1c5ccafa5926b86dc8e98e899a0127ec29635c144c1ebef861fba254e37f3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NBug.dll
        • Path C:\Program Files (x86)\Wisenet\Wisenet Device Manager\NBug.dll
        • Size 169KB
        • SHA256 163158c90b481dc3ad0badfc17f35ce0cc720e4e332d9e14ef7d37e2a1e190de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Telerik.WinControls.GridView.dll
        • Path C:\Program Files (x86)\Wisenet\Wisenet Device Manager\Telerik.WinControls.GridView.dll
        • Size 1.6MB
        • SHA256 48a2a7b95b70eb58b9d2c79ae0a18706946107ca639cefcf4404acd716c15097
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Telerik.WinControls.Themes.Desert.dll
        • Path C:\Program Files (x86)\Wisenet\Wisenet Device Manager\Telerik.WinControls.Themes.Desert.dll
        • Size 663KB
        • SHA256 abff054381fcb84a5eb0d8ce8f215da3d85bbfd9231f79311e7d654613cf4f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Telerik.WinControls.Themes.Office2013Dark.dll
        • Path C:\Program Files (x86)\Wisenet\Wisenet Device Manager\Telerik.WinControls.Themes.Office2013Dark.dll
        • Size 225KB
        • SHA256 868c927723783da1a0d7f1a2dfee47781b48611bbd447888a60b6c47faa4322d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Telerik.WinControls.Themes.VisualStudio2012Light.dll
        • Path C:\Program Files (x86)\Wisenet\Wisenet Device Manager\Telerik.WinControls.Themes.VisualStudio2012Light.dll
        • Size 256KB
        • SHA256 48c25bb6be0ab52387d6aa27e6e43947487bfe53c61c20d71b1c1f1b72a86322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Telerik.WinControls.UI.dll
        • Path C:\Program Files (x86)\Wisenet\Wisenet Device Manager\Telerik.WinControls.UI.dll
        • Size 6.2MB
        • SHA256 c231a0a24e4d209c96279a669228a746b11be32117c2cfe918a658a72923d242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Telerik.WinControls.dll
        • Path C:\Program Files (x86)\Wisenet\Wisenet Device Manager\Telerik.WinControls.dll
        • Size 4.3MB
        • SHA256 9a8ba69ce79ff7373792096d2db982b3d4fee2831b167efec9600b40ad304083
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TelerikCommon.dll
        • Path C:\Program Files (x86)\Wisenet\Wisenet Device Manager\TelerikCommon.dll
        • Size 898KB
        • SHA256 2f70fc3eab3ce9aec6ddaf40be9f71b469e0e85334ac0389892edc94b5cdf38f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UserConfig.xml
        • Path C:\Program Files (x86)\Wisenet\Wisenet Device Manager\UserConfig.xml
        • Size 5KB
        • SHA256 f1e9bfd9aa4c3cf556b38193c42d85cf6fe3c4cd369f4363dc24678a7d30c183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wisenet Device Manager.exe
        • Path C:\Program Files (x86)\Wisenet\Wisenet Device Manager\Wisenet Device Manager.exe
        • Size 34.5MB
        • SHA256 17bbf61c2799c35ae9305093695a501f22c34d6498ed2dbb5a30282f583c59a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Wisenet Device Manager.exe.config
        • Path C:\Program Files (x86)\Wisenet\Wisenet Device Manager\Wisenet Device Manager.exe.config
        • Size 1KB
        • SHA256 28517b01be6e2cec07b3095e87c4b88ab5aa59fd5cd88d697792f7da4f16a0e1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
        • Size 1KB
        • SHA256 8107f3734104ae370f8a04944454b29d93beef7fbf47d442cad385ee8709ea68
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BD92F95DED26541D3AF7F44DC7914843
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD92F95DED26541D3AF7F44DC7914843
        • Size 721B
        • SHA256 4900b7c4a1e108d5f6230e5db947856d9497c66edbd68cde74583fc7451e96cd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
        • Size 536B
        • SHA256 c4b79ce5c7f2f82d3ee91e3c2a7042a871f73e0a6e271b54945046c7beb19e10
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BD92F95DED26541D3AF7F44DC7914843
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD92F95DED26541D3AF7F44DC7914843
        • Size 214B
        • SHA256 e020b3a795459ef7e3a49ee1d0e6bbfda63c44d7c38f3787ab8d8eca30cd69b2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VERSION.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\VERSION.dll
        • Size 2.7MB
        • SHA256 a09923899b318848d44dc706ccc1d3489a383b9af0921351134d14a152a7925b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icardagt.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
        • Size 1.3MB
        • SHA256 473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LangDLL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsfB7E3.tmp\LangDLL.dll
        • Size 5KB
        • SHA256 32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsfB7E3.tmp\System.dll
        • Size 12KB
        • SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        modern-wizard.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\nsfB7E3.tmp\modern-wizard.bmp
        • Size 185KB
        • SHA256 c61f379085d075dd3d5b3cc2004d429e81244f00b58652f912e8f983292b2eb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsfB7E3.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsProcess.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsfB7E3.tmp\nsProcess.dll
        • Size 4KB
        • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 24.1MB
        • SHA256 b57ab8d02dc03a51066c7977386b7562637b5ada047b9154e860f62567620b23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {088deeb0-bcb5-4791-9d97-13f847a0353f}_OnDiskSnapshotProp
        • Path \??\Volume{12d9ef41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{088deeb0-bcb5-4791-9d97-13f847a0353f}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 64a2229eeed56564c4bdd92b5cdde5f346b5c65d8b80206aa2072d42ed009507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1132-44-0x0000000002E20000-0x000000000355F000-memory.dmp
        Download

        memory/1132-72-0x0000000002E20000-0x000000000355F000-memory.dmp
        Download

        memory/3668-365-0x000001EB742A0000-0x000001EB746FC000-memory.dmp
        Download

        memory/3668-363-0x000001EB73D50000-0x000001EB73E36000-memory.dmp
        Download

        memory/3668-370-0x000001EB74DB0000-0x000001EB74F56000-memory.dmp
        Download

        memory/3668-352-0x000001EB73710000-0x000001EB73D48000-memory.dmp
        Download

        memory/3668-376-0x000001EB74C40000-0x000001EB74C86000-memory.dmp
        Download

        memory/3668-350-0x000001EB70530000-0x000001EB70560000-memory.dmp
        Download

        memory/3668-374-0x000001EB74CF0000-0x000001EB74D9C000-memory.dmp
        Download

        memory/3668-372-0x000001EB74C00000-0x000001EB74C3E000-memory.dmp
        Download

        memory/3668-348-0x000001EB6C2C0000-0x000001EB6E538000-memory.dmp
        Download