bumblebee | 31dd6d070a65a648b2be9ea2edc9efca26762c3875a8dde2d018eb064bc41e32

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/06/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmp0mi28a04.msi
Size 3.7MB
Sample260609-bcat9sh19w
SHA256 31dd6d070a65a648b2be9ea2edc9efca26762c3875a8dde2d018eb064bc41e32
MD5 28c0caed1c9c242f60c8e0884ccbf976
SHA1 0e6abeb79a84fc3e7683c5439607c8a17ef6ae77
SHA512 7b3637ef5de221dc34684fa2a5746b54d8cdc373cba9486cfd9e496c930088713b8875759fe6027b4c827be8f8a11fc3d97d31d8519f62eb31244dea00ddb7ee
SSDEEP 98304:uU8uEL5HQ++zzvBXzSnmw5KxYXyuDB7KR5:uU87Qt1iCOBA5
TLSH
T13706338236458F03D5D7A53B02E56DCA4A2EFC20EF6F910A12A67F4D07317472BB86D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

grp0003 bumblebee loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

grp0003

Attributes

dga
19ak90ckxyjxc.life

o2u1xbm9xoq4p.life

9b10t4vyvx6b5.life

9nl2a1qma4swd.life

gc9fctjq62t2e.life

apsgw881ol7rs.life

rmqa3jodwcmgd.life

85ur7zivhczam.life

evzftxl2qjfj4.life

cp2br7osw928r.life

lhunevjdxw5kz.life

jbrprj8im7aia.life

rdg0u5n7237r5.life

xwn7sukhzhbqv.life

8vh7uizstjhnb.life

u8karkeeu2qtj.life

j34duklow92k3.life

8sg769rvpe1lp.life

inkja7hekgcuv.life

r4a4n001s7uhi.life

r976ptnxbh52l.life

tv9jc206cpnyd.life

xf30997j6tp8z.life

nl2jkkuqs8efp.life

5395dg0j4h79n.life

v30ty639krk3p.life

oknzqkp6ph302.life

rlq13ng659buz.life

ey9n44bwtmjaw.life

trtiqjiry7k05.life

9vgvnzk51j1sy.life

wi88w99xo9zlt.life

hoieva2gl9tzx.life

7oo4hxt5haih5.life

ey8axyn00x8sf.life

kks80hyrpbmuz.life

zom3rkt078g1k.life

n2cy5wx4nfs8n.life

qnw1tsg4ogxa0.life

84ntpl4mk4cwm.life

m5f2awao92hp9.life

nq0tsip71ecq5.life

ithg3ysseil61.life

mvp5pt36h20vf.life

51415jvbttwu4.life

l0ecv85wptocs.life

nuq0isjlua30l.life

wd7jo4d8zlxg0.life

2885patz8ovcf.life

1zwze7b6jqovz.life

s23kd323qzj2l.life

4me127ppi31at.life

eifir9x2xpqsb.life

4hlnzokni29fh.life

ykv99faqy3ky4.life

bgiphdk30zk35.life

8n3rj69ohv8rv.life

29e8eji42sktd.life

bqlbyaavprz19.life

qj2suuu4ixgvf.life

b2ys2fltibnfu.life

z0lg8lijtw3mh.life

p3arx0taom00w.life

gquyy1qf8ncn7.life

ref18bh4aku24.life

epqykfhm5zq6l.life

zw96t31o1h768.life

c45ze0b5hhvdg.life

6kjpjs3v34hbf.life

qhyut7e0tjz2a.life

5p9udlfi4yvg6.life

5ew1715l4z3ef.life

xfi23ljskvgtg.life

ofvs2a3nhyrqi.life

7o3zfbd5rf5mz.life

flewo6le618h7.life

r7rw9inm558jg.life

7qjjcy6vg835x.life

8sz83ieffpzwj.life

0eftob9vxa877.life

0j62jm3djgxe7.life

v2vijxyqbqsbl.life

vuu79f2ne8xl1.life

ew3crbjgfbbhd.life

lqhhfpiqp5chx.life

f3be5ccj5ioc7.life

1ngmbwokqkiov.life

nh0hujf2w5xi9.life

daxbkb16ebdao.life

m4ivqiz0weqy7.life

0ei4jxf0cszgd.life

54zgxvq8jzq81.life

tesc2obtfbdke.life

w1nd36e506qqi.life

fc4v5wx4p4syq.life

43wubiwvmajs3.life

4w1b7rsnyg3sm.life

h8gw0cbhkkrrf.life

k2yu4bhadklet.life

wqfvb1lom02cg.life
dga_seed
7941704092191845612
domain_length
13
num_dga_domains
300
port
443
tld
.life

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Executes dropped EXE 2 IoCs

pid	Process
4236	WinMTR.exe
4112	icardagt.exe

Loads dropped DLL 1 IoCs

pid	Process
4112	icardagt.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4220	msiexec.exe
7	4220	msiexec.exe
27	4220	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58c3a9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC4F1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58c3a9.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757}	msiexec.exe
File created	C:\Windows\Installer\e58c3ab.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4220	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f94cc820840d1c590000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f94cc8200000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f94cc820000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af94cc820000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df94cc820000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\WinMTR\Config	WinMTR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\LRU\NrLRU = "0"	WinMTR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	WinMTR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\Config\PingSize = "64"	WinMTR.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\Version = "0.9"	WinMTR.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\HomePage = "http://WinMTR.sourceforge.net"	WinMTR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\Config\MaxLRU = "128"	WinMTR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\Config\Interval = "1000"	WinMTR.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\WinMTR	WinMTR.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\License = "GPL - GNU Public License"	WinMTR.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\WinMTR\Config\UseDNS = "1"	WinMTR.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\WinMTR\LRU	WinMTR.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "WinMTR"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmp0mi28a04.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "A254DD783317BC94C9DD65976D82B1C1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4172	msiexec.exe
4172	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4220	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4220	msiexec.exe
Token: SeSecurityPrivilege	4172	msiexec.exe
Token: SeCreateTokenPrivilege	4220	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4220	msiexec.exe
Token: SeLockMemoryPrivilege	4220	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4220	msiexec.exe
Token: SeMachineAccountPrivilege	4220	msiexec.exe
Token: SeTcbPrivilege	4220	msiexec.exe
Token: SeSecurityPrivilege	4220	msiexec.exe
Token: SeTakeOwnershipPrivilege	4220	msiexec.exe
Token: SeLoadDriverPrivilege	4220	msiexec.exe
Token: SeSystemProfilePrivilege	4220	msiexec.exe
Token: SeSystemtimePrivilege	4220	msiexec.exe
Token: SeProfSingleProcessPrivilege	4220	msiexec.exe
Token: SeIncBasePriorityPrivilege	4220	msiexec.exe
Token: SeCreatePagefilePrivilege	4220	msiexec.exe
Token: SeCreatePermanentPrivilege	4220	msiexec.exe
Token: SeBackupPrivilege	4220	msiexec.exe
Token: SeRestorePrivilege	4220	msiexec.exe
Token: SeShutdownPrivilege	4220	msiexec.exe
Token: SeDebugPrivilege	4220	msiexec.exe
Token: SeAuditPrivilege	4220	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4220	msiexec.exe
Token: SeChangeNotifyPrivilege	4220	msiexec.exe
Token: SeRemoteShutdownPrivilege	4220	msiexec.exe
Token: SeUndockPrivilege	4220	msiexec.exe
Token: SeSyncAgentPrivilege	4220	msiexec.exe
Token: SeEnableDelegationPrivilege	4220	msiexec.exe
Token: SeManageVolumePrivilege	4220	msiexec.exe
Token: SeImpersonatePrivilege	4220	msiexec.exe
Token: SeCreateGlobalPrivilege	4220	msiexec.exe
Token: SeBackupPrivilege	1012	vssvc.exe
Token: SeRestorePrivilege	1012	vssvc.exe
Token: SeAuditPrivilege	1012	vssvc.exe
Token: SeBackupPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe
Token: SeTakeOwnershipPrivilege	4172	msiexec.exe
Token: SeRestorePrivilege	4172	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4220	msiexec.exe
4220	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4236	WinMTR.exe
4236	WinMTR.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4144	4172	msiexec.exe	100
PID 4172 wrote to memory of 4236	4172	msiexec.exe	103
PID 4172 wrote to memory of 4112	4172	msiexec.exe	102

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp0mi28a04.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4220

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4144
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4112
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WinMTR.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WinMTR.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:4236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58c3aa.rbs

Path C:\Config.Msi\e58c3aa.rbs
Size 7KB
SHA256 a74acd26e4d1217423ac0693df4df408ba6dc0542da11ea51f3fc8073466c632
MD5 1935107b05022c2a41644aa438288282
SHA1 89d0fe8bb76fab908c9dc2785a9d4c3faeef0fbe
SHA512 1c1c421040c434df1c321844fbc289ae2f07bcff0df3ef63fabfd069d3bd67e3d5a9a65fa57930bb13570542dd3b5dd742e2ecdfc25ca9d34fa0b5e82b82b0c4
SSDEEP 96:armYUtbJ6JEUKUwp8ZeSHMaUCrjKITCsTlqUCrjKITCWd/XTlr/A5UhZWXuLZCMt:aCJtEI8ZeFtSOIbSO+ukZ0Mpr
TLSH
T1DAF11141B31181D3E892573ACB0B276A37B3D7DDD6D0230F09CD92686E527C95FE628A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
Size 1KB
SHA256 b4076dea543e21614438cb7eb2ad4c45d06ba1a656349089eefa73247bbc783f
MD5 aa8a971a87cd5faa39699dadc7f5ddb4
SHA1 0db44f4ae6414727c6489e14fd5371299ecc7427
SHA512 cbc251f1374fc70d281069e12bfdd4eebe2d090c63e0a8463ecc3f41af76e855bf6168140d7b2e2681698d33fbe993d8066b9d4b93f9464486dc4a42839edeba
TLSH
T15531D88E112D2E866ADECF249CC694006C3895E4EEBC7922117BC23969403E32F66429
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
MD5 b8ba8f85f7c99fad7c22cd60f641a964
SHA1 1ee69e5d2f0de776851c90a3e2cb4fdaf63fa934
SHA512 5c3f06b145fb795f194e08ca7cc23c3f180757575126e756d843c87b2607d6295c8cb69f457658733efbe509283f57f3cd4f88f7855b3f486e68a01e89881720
TLSH
T13F31D8771F6CB5208E128D8426CDFA725970DAE0989A10797218DB176C80BB38B1559B
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
Size 536B
SHA256 060326f01722184b03a947dc27cf9aa845a851e8ce3f9044ef468cf2210918fd
MD5 0b48007c47ae1c92f38300dcf3ba5542
SHA1 522ac0a94ef00a3920de90923999eadb409ae45b
SHA512 d3b0e63cc5378f33b1fc2bd7e6d1e4082de2a8e7e517715cc2932163ad27953a5ec5c16e891a7dde258ea196b6eef4360f520dc47ddde10117320ca062799340
TLSH
T12AF09E3050F9001FF174DA7806E2A645ADA9F90324218A1459B9430D7E60D402D93E3F
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 ca734f93c98727171ff5ba99b0c9f653c40ecf5d66e9d871e10bbf270e68ff78
MD5 9b697601880d037183ec3560783595cf
SHA1 9858a98f185cbc465b5de3963f5012037651ce85
SHA512 d6fe3f6420b29abd1c52587f772d1d48021afb8f9516f3ec0f9b68be2d2cd08820dc8a23ea28e3c70871e10b7362643b823a6808f060285f7b48a5986af29b0e
TLSH
T167F05C1419F5831EF8B2DA791DE95516FA15FD027C259BED025A4B1E3D20B108D3782D
MD5 SHA1 SHA512 TLSH

Submit Download

WinMTR.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WinMTR.exe
Size 2.3MB
SHA256 9ad74a0f18ce39a0d92a9dabc6ef7ebb2aebf1471ed868f14e183faf0123eb87
MD5 7174ccf02161dab6e424e2de83807deb
SHA1 dbaef2cbdd50d56e2d6bbd63991d22391526894b
SHA512 3feb78fc4b60dc089c7c84b31ab3d676458c82d91b3a1c12db469dbb6d56b13a62cb3cfa3e5bd94490a89c659d6d17caff8e1a5060ebb49a81529aeda15e0f5f
SSDEEP 49152:jgUtLamQ9h/eWg7dfN/RODru+USamit26nFd2b3g2:kua9c17dpt26n2b3g
TLSH
T1FBB55B5B22B861F4E0668176C407874BC7F274720B35C3CF50A517AE1FB76B60DAA7A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icardagt.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
Size 1.3MB
SHA256 473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
MD5 2fe97a3052e847190a9775431292a3a3
SHA1 43edc451ac97365600391fa4af15476a30423ff6
SHA512 93ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a
SSDEEP 12288:pvRneDBcP5s/UdTEQa8DOmJRJmILwCHEA188KijZZLr0X+c/d2zlNRTSTNo7I8:phe4kRQa8DO6JmJCvrKimZ4zlNRTST38
TLSH
T1D955F969F97C4176E121D4BFD183DA4AD1B230422B305AE74262CF6E1E3F5D6A13A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dll

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\version.dll
Size 3.4MB
SHA256 96480ef5ccfa8fcb0646538c440103d97ab741ed83f4c2bcb7b4717569f88770
MD5 a67fa1a060c07934c3de8612aaa0ebc2
SHA1 d1c5b38d3d91f925b16d616c1c9d3e05542f025d
SHA512 303daff6ef1e8f84fce5528badfb8eb935c8b6f9688ebfbbadfe0a43dae208363ff96172429200d014d0e608cf99d8595906f7e774cb5efd68bfe9f1686fb6ce
SSDEEP 49152:+3PYkqzfH5TWZzpHWO2WYIgzMhGByFi2T1QKTZMmC5lZLVNLjssT6Rvl:+3AkuH9WZzpHWO2WYFMIBebizsTf
TLSH
T134F55B06EB7F4A5DE550C4BE96771263D8697D0CD028B8758EC00B057FA2F60A67A3EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58c3a9.msi

Path C:\Windows\Installer\e58c3a9.msi
Size 3.7MB
SHA256 31dd6d070a65a648b2be9ea2edc9efca26762c3875a8dde2d018eb064bc41e32
MD5 28c0caed1c9c242f60c8e0884ccbf976
SHA1 0e6abeb79a84fc3e7683c5439607c8a17ef6ae77
SHA512 7b3637ef5de221dc34684fa2a5746b54d8cdc373cba9486cfd9e496c930088713b8875759fe6027b4c827be8f8a11fc3d97d31d8519f62eb31244dea00ddb7ee
SSDEEP 98304:uU8uEL5HQ++zzvBXzSnmw5KxYXyuDB7KR5:uU87Qt1iCOBA5
TLSH
T13706338236458F03D5D7A53B02E56DCA4A2EFC20EF6F910A12A67F4D07317472BB86D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 4244c3c3ee112533c06906fee8eee853ca5e4fd301c33932a17d7e571fd28372
MD5 8dff282f44948fabb4bfa615ea624d66
SHA1 d346209b6052ca546de1d9be4df06c458f9be53d
SHA512 1c812c83deeee044ae57328132f4a9a3dca2259e5de4f7b204177799b969834adc0358c0780b75c4db63a09981fb65b0eab2664f1697bb284072250926170403
SSDEEP 24576:+u8m+1zYdoO/vvTLrWceJG64dl0zEVMiwKmNeTtlU06tuLlBovVFk6XRp:Z
TLSH
T19147E42436F92110E7F79E3CA8F16A234D3A7D5B8C159E8D05411B4E0962FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e9f996e2-4f94-4b16-bb39-e87f1a52959f}_OnDiskSnapshotProp

Path \??\Volume{20c84cf9-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e9f996e2-4f94-4b16-bb39-e87f1a52959f}_OnDiskSnapshotProp
Size 6KB
SHA256 6c92f3e4186de46674caa5e15755d368a39fabfa0cdd9cb39930ed471be52bbb
MD5 bbcd0a77b2d08d9766264da46584c31f
SHA1 bda8eca64b391e58b6edba87e0f71774c1e2a21d
SHA512 2a012ba1ae2abd625e60bc7d4916f99304c8275d35d5cb8c8f5ba7d701d71a63ac9d55e5ac6b3ef451308a607cddee7fbdb55d1b544e8b33a5c914c6fdc08f71
SSDEEP 96:Ft3NcA47vc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:f3sxb++ZVm
TLSH
T136D1890C5AF54311E2B3AB7129F18557A877B911EF33CB8E0298238E2671910F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4112-43-0x0000000002C50000-0x000000000338F000-memory.dmp

Download

memory/4112-47-0x0000000002C50000-0x000000000338F000-memory.dmp

Download