bumblebee | 8f424f4d327cb1032a0d6679d6d42ac44614131ecabd544244d03808c8b32e30

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/06/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpp7rc_rgi.msi
Size 2.9MB
Sample260609-bctmdaav7q
SHA256 8f424f4d327cb1032a0d6679d6d42ac44614131ecabd544244d03808c8b32e30
MD5 57615643093558c917c266d72bdc4121
SHA1 577694e2e017d726b8043e9badaa525407c539b3
SHA512 b1ba8294e8ff08c1289319e4c587fdea930350997979d7477fb9b397130bda164dad31d7d07eee7bd3ffac61f0c3e379a716571da4c7aa76157ec85651b1581c
SSDEEP 49152:bJrROW2qZLSv2c5Xq//eirNPmaxKWnfKtI4yhFmL2+v4vs3hWSN:bJrROWfLSv2tnt3c6BzhFmFwWhW
TLSH
T18BD533629F5C0660E80741B00B4FD6254DA9FD81DF5083598D83B6989A3E7FCBFBA097
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

grp0004 bumblebee loader persistence privilege_escalation ransomware

Malware Config

Extracted

Family

bumblebee

Botnet

grp0004

Attributes

dga
19ak90ckxyjxc.life

o2u1xbm9xoq4p.life

9b10t4vyvx6b5.life

9nl2a1qma4swd.life

gc9fctjq62t2e.life

apsgw881ol7rs.life

rmqa3jodwcmgd.life

85ur7zivhczam.life

evzftxl2qjfj4.life

cp2br7osw928r.life

lhunevjdxw5kz.life

jbrprj8im7aia.life

rdg0u5n7237r5.life

xwn7sukhzhbqv.life

8vh7uizstjhnb.life

u8karkeeu2qtj.life

j34duklow92k3.life

8sg769rvpe1lp.life

inkja7hekgcuv.life

r4a4n001s7uhi.life

r976ptnxbh52l.life

tv9jc206cpnyd.life

xf30997j6tp8z.life

nl2jkkuqs8efp.life

5395dg0j4h79n.life

v30ty639krk3p.life

oknzqkp6ph302.life

rlq13ng659buz.life

ey9n44bwtmjaw.life

trtiqjiry7k05.life

9vgvnzk51j1sy.life

wi88w99xo9zlt.life

hoieva2gl9tzx.life

7oo4hxt5haih5.life

ey8axyn00x8sf.life

kks80hyrpbmuz.life

zom3rkt078g1k.life

n2cy5wx4nfs8n.life

qnw1tsg4ogxa0.life

84ntpl4mk4cwm.life

m5f2awao92hp9.life

nq0tsip71ecq5.life

ithg3ysseil61.life

mvp5pt36h20vf.life

51415jvbttwu4.life

l0ecv85wptocs.life

nuq0isjlua30l.life

wd7jo4d8zlxg0.life

2885patz8ovcf.life

1zwze7b6jqovz.life

s23kd323qzj2l.life

4me127ppi31at.life

eifir9x2xpqsb.life

4hlnzokni29fh.life

ykv99faqy3ky4.life

bgiphdk30zk35.life

8n3rj69ohv8rv.life

29e8eji42sktd.life

bqlbyaavprz19.life

qj2suuu4ixgvf.life

b2ys2fltibnfu.life

z0lg8lijtw3mh.life

p3arx0taom00w.life

gquyy1qf8ncn7.life

ref18bh4aku24.life

epqykfhm5zq6l.life

zw96t31o1h768.life

c45ze0b5hhvdg.life

6kjpjs3v34hbf.life

qhyut7e0tjz2a.life

5p9udlfi4yvg6.life

5ew1715l4z3ef.life

xfi23ljskvgtg.life

ofvs2a3nhyrqi.life

7o3zfbd5rf5mz.life

flewo6le618h7.life

r7rw9inm558jg.life

7qjjcy6vg835x.life

8sz83ieffpzwj.life

0eftob9vxa877.life

0j62jm3djgxe7.life

v2vijxyqbqsbl.life

vuu79f2ne8xl1.life

ew3crbjgfbbhd.life

lqhhfpiqp5chx.life

f3be5ccj5ioc7.life

1ngmbwokqkiov.life

nh0hujf2w5xi9.life

daxbkb16ebdao.life

m4ivqiz0weqy7.life

0ei4jxf0cszgd.life

54zgxvq8jzq81.life

tesc2obtfbdke.life

w1nd36e506qqi.life

fc4v5wx4p4syq.life

43wubiwvmajs3.life

4w1b7rsnyg3sm.life

h8gw0cbhkkrrf.life

k2yu4bhadklet.life

wqfvb1lom02cg.life
dga_seed
7941704092191845612
domain_length
13
num_dga_domains
300
port
443
tld
.life

rc4.plain

Signatures

Family: BumbleBee
BumbleBee is a loader malware written in C++.
loader bumblebee

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral3/files/0x001900000002b5fb-30.dat	Nirsoft

Executes dropped EXE 2 IoCs

pid	Process
4500	WNetWatcher.exe
3452	icardagt.exe

Loads dropped DLL 2 IoCs

pid	Process
4500	WNetWatcher.exe
3452	icardagt.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4232	msiexec.exe
3	4232	msiexec.exe
4	4232	msiexec.exe
5	4232	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFAC53EFA5C88DF38B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5E09.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF783AF112A5ADE9A2.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF451758941FD20A57.TMP	msiexec.exe
File created	C:\Windows\Installer\e585c85.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA56B2C4E6007EA9B.TMP	msiexec.exe
File created	C:\Windows\Installer\e585c83.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e585c83.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD475EBC-D961-4AF4-BB8A-BE91FA942757}	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4232	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b7671573c6f2ce060000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b76715730000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900b7671573000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ab7671573000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db7671573000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275\AppLicense	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\ProductName = "Wireless"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\PackageName = "tmpp7rc_rgi.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\PackageCode = "DBD8D53B074706642B1CCC3346FBCC3D"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\CBE574DD169D4FA4BBA8EB19AF497275\Clients = 3a0000000000	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3268	msiexec.exe
3268	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4500	WNetWatcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4232	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4232	msiexec.exe
Token: SeSecurityPrivilege	3268	msiexec.exe
Token: SeCreateTokenPrivilege	4232	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4232	msiexec.exe
Token: SeLockMemoryPrivilege	4232	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4232	msiexec.exe
Token: SeMachineAccountPrivilege	4232	msiexec.exe
Token: SeTcbPrivilege	4232	msiexec.exe
Token: SeSecurityPrivilege	4232	msiexec.exe
Token: SeTakeOwnershipPrivilege	4232	msiexec.exe
Token: SeLoadDriverPrivilege	4232	msiexec.exe
Token: SeSystemProfilePrivilege	4232	msiexec.exe
Token: SeSystemtimePrivilege	4232	msiexec.exe
Token: SeProfSingleProcessPrivilege	4232	msiexec.exe
Token: SeIncBasePriorityPrivilege	4232	msiexec.exe
Token: SeCreatePagefilePrivilege	4232	msiexec.exe
Token: SeCreatePermanentPrivilege	4232	msiexec.exe
Token: SeBackupPrivilege	4232	msiexec.exe
Token: SeRestorePrivilege	4232	msiexec.exe
Token: SeShutdownPrivilege	4232	msiexec.exe
Token: SeDebugPrivilege	4232	msiexec.exe
Token: SeAuditPrivilege	4232	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4232	msiexec.exe
Token: SeChangeNotifyPrivilege	4232	msiexec.exe
Token: SeRemoteShutdownPrivilege	4232	msiexec.exe
Token: SeUndockPrivilege	4232	msiexec.exe
Token: SeSyncAgentPrivilege	4232	msiexec.exe
Token: SeEnableDelegationPrivilege	4232	msiexec.exe
Token: SeManageVolumePrivilege	4232	msiexec.exe
Token: SeImpersonatePrivilege	4232	msiexec.exe
Token: SeCreateGlobalPrivilege	4232	msiexec.exe
Token: SeBackupPrivilege	1936	vssvc.exe
Token: SeRestorePrivilege	1936	vssvc.exe
Token: SeAuditPrivilege	1936	vssvc.exe
Token: SeBackupPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe
Token: SeTakeOwnershipPrivilege	3268	msiexec.exe
Token: SeRestorePrivilege	3268	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4232	msiexec.exe
4232	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 5204	3268	msiexec.exe	84
PID 3268 wrote to memory of 4500	3268	msiexec.exe	87
PID 3268 wrote to memory of 3452	3268	msiexec.exe	86

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmpp7rc_rgi.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4232

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5204
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3452
- C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WNetWatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WNetWatcher.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e585c84.rbs

Path C:\Config.Msi\e585c84.rbs
Size 7KB
SHA256 284ff61600d9618d16e14596b3d72b2595b06f28315a5d25fa06eb2277910aa6
MD5 b2821c6f9d973025899cc735bacdcf62
SHA1 5cf7cdf5bfc94892dff299e25c90fe5dde313b51
SHA512 35e3edd0cd87855dbaf645c94dc58fcb57eff04e97da39f89bb4d0fee133b5e9249c6b850aae134ae5293f485d5e9ba5d2fdefbe47ab666597da90277e50a59c
SSDEEP 96:PmyJ6JCy/vwp8oCXNMaUCrWWTCsTlqUCrWWTCWd/KTlr+A5UhZWXuL3wCMpoBGjb:usEW8oCKtEOIbEOfdkZv3Mpz
TLSH
T173F12041B31181E2EC52573ACB0B27563BB7D3DDD7D0230B09CD92A86E527895FE62CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
Size 1KB
SHA256 8107f3734104ae370f8a04944454b29d93beef7fbf47d442cad385ee8709ea68
MD5 7f0217696f8563cd414662ba8c70399e
SHA1 aba2e157d896215b90a20294e76ec2e902d6af7c
SHA512 141b85e016ea49c83921535c34144943a11264b94b1cdbfbc3ba2ed8a00718d4d489090ca52e387184406fa1ce48e79bc68912042126fcbbd6f89dff0e034c13
TLSH
T18431064A191D3CD6B9DACF586CCB9110BC38A0F06EACA020113BC126A0002D32B6B469
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 972e428c144b832ee495097b5de6d23fccf63d85ecb5726e7f4868570d6b9c9b
MD5 7045dffcdab1f570a45ad10afac7c276
SHA1 3facc9c3a3216babd747531f83f9bd37a63f907f
SHA512 8fc2deeb696ebaeb06f1a66328c6063176774a7878fd006817c16e797b4fe61e456531cc8a0c3ef370c0e592fc44764216d94a741b0ce569173a2a9a69ad4761
TLSH
T19F31FA236F2C68308E524DB02AD9EE7219B0C5D52CEB606A7118D91718C1BF69F5554B
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_33E4C7534F38E75439A639B049B41DA3
Size 536B
SHA256 25e5c938903f044c6244c963d27edb5211fb9c5bc35a756a76481a5f5b5c5bab
MD5 614cf08c440494d94115fa0b45ca7690
SHA1 076d1a5b47aa411a044a42263678918dd6921f52
SHA512 e5e0fe8a57bc6ab04eff8f304c6335c98fb4cd9fb385ddb607f55b46e5ec871b2839ba3a1b9e588050ba1ecd0ebbb761d54a3c6584f4aa74d4334d45e4b927eb
TLSH
T186F09E3954F6011EF072EA7407D6A2976D6DFE1238219A581599434E7D61E402C42A37
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 f82792a8d42f68801ec58195768031c067a2344ede7f12af4a10a7a1360fe32e
MD5 cae1cf950d38d37824e749e045c34634
SHA1 9a233f2d01e47e7ece2015d0b04f3a164b93a15f
SHA512 c35c614512096360e2d434ccab8c56eb975e26f9a61156ca89f4a3bde60f9e8ad4c268cd874cc616467cf286c0b4c0fecbba18bda4ef55e182bbd9c3b778ecd2
TLSH
T16DF0DC2405B1133DF577DA790BC9A026AB16F8133C70CF62122B0B5E2D31B00AC3352A
MD5 SHA1 SHA512 TLSH

Submit Download

VERSION.dll

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\VERSION.dll
Size 2.7MB
SHA256 a09923899b318848d44dc706ccc1d3489a383b9af0921351134d14a152a7925b
MD5 18689fd0311a64a712a313d58fccbbfe
SHA1 c135d29186faa04602d90e96d17aaf58fe16b8f7
SHA512 3a7d0129da9d079f4cf5266b3c70ea950ed852b3573abae9aadd9eab1db68dea330eac5ed23c78426ea1bffd5d75aa416b2d2ce39349bafccea9e429301212e0
SSDEEP 49152:/yCl4fYhi7rch+A0UiepgqALMwajmaPUDiLIscxgyLGURN+y4J:/R/Pge0bLGUS9
TLSH
T1ADD58D0A2B3B4A5ED521C4BD92771223C469BDFCC018B5798DC04B457FA2F60A67A7EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WNetWatcher.cfg

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WNetWatcher.cfg
Size 295B
SHA256 9ff3514f64738e6b7472c51affbb21f90c6f0b7d219bd57a818fcfaa5866d6a4
MD5 d200b37aeaf66a49ec080e6fa860f23a
SHA1 a8db2268b11d2a0c27647307093f9245b4f731a1
SHA512 92d5b3aad32c34548ff6241cfc023038c5178e1b480b74b746cdddf46a8cf9c677d1b008afda41f1c21149d7fab954e475ddec82fb6470a4f2e27782824a56a6
TLSH
T160E07D5C21F6193D0B0F77E018350C0B270BE410076510159607B0558DBC01B04CC2BF
MD5 SHA1 SHA512 TLSH

Submit Download

WNetWatcher.cfg

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WNetWatcher.cfg
Size 295B
SHA256 55a62bb0d50da0ba915b4145c812ec4a625a75af874459850efbf02ff63e8471
MD5 277e1589a6691e4740ec4533dad91aef
SHA1 885f73671ca4dbae146de78ff8e2f7c4054ad0e5
SHA512 97a7af7bda6cf79b0cb2aa6377cd0d85a4d72ca5d46ae39fa66b57307527750dcd93c53d70af17edd99a4ec97bca067ae4478421bc345aeeff2b49585f604433
TLSH
T19BE0726C22FA193E0B0FBBE0287A0C0B270BE42002292014920BB0998DBC41B088C3BF
MD5 SHA1 SHA512 TLSH

Submit Download

WNetWatcher.cfg

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WNetWatcher.cfg
Size 295B
SHA256 475f8518406dcd8a5e7f107358cc2e743150a3a7cb19ef2cde0e85a197ad6507
MD5 10941484dae3599ddb0dd441d5657252
SHA1 64db755d37978b842fe51990b350d2033313df94
SHA512 18bc79f7313de0fe198bb6fc421c9b0438f8e7f603be935cd487fdefaec4e77d7921e3552f79821207fd5a0f9187ad42f42638dfbb23e9d02fa137a280f7b2e7
TLSH
T1DEE07D5C21F5183D0B0F77E018360C0B170BE41002251014920770558DBC017088C3BF
MD5 SHA1 SHA512 TLSH

Submit Download

WNetWatcher.cfg

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WNetWatcher.cfg
Size 295B
SHA256 29a0661c04619aa21d67a9c03b5920657df991f514ae25eff94b061fbd7c5297
MD5 7ab9a40a5a6558b6c2d823dcc59d927e
SHA1 91bf85e15c7b5d55979daa60f8136886d696b8d2
SHA512 84ddce3a0b43cdaa430afc8067ebd7e1c3acf6a6825e67d140d3ad8d0f643cf159b7493f7fe2506c7fbd6f9c82dff372305afae44503a94acdac87246c5dc89a
TLSH
T1F4E0726C22FA193E0B0FB7E028360C0B270BE420022920149207B0998DBC01B088C3BF
MD5 SHA1 SHA512 TLSH

Submit Download

WNetWatcher.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\WNetWatcher.exe
Size 1.3MB
SHA256 885dd208cd794ff755e15de13ca2918b2a60bfb98d4449216e774929bb21a583
MD5 1116b9a64237fac4e98646f0ea24ac67
SHA1 7686ba34488b46378a80eff069d6116051f1b37f
SHA512 2a4b181949aecbe71cd90f5e5d545cbabc77099370aa48be19fa7f1ee3cf974cb755fea99909705ebe8dfa04a7fa25c9a4513786e3f6337f64405ede32713751
SSDEEP 24576:LHIPkq32fF9GZYsF86zOxRCmKZs9sC6oveLVcn927AhZhgBECrTScWKwutkOLHi9:LHIPkq32fXG2sF86zOxRCm+s9/6oveLe
TLSH
T1CD55D6D4777FB5B2E70E25AD36822FC51A3E6A8C311C53123239849091FB8AF77D8919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icardagt.exe

Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\icardagt.exe
Size 1.3MB
SHA256 473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
MD5 2fe97a3052e847190a9775431292a3a3
SHA1 43edc451ac97365600391fa4af15476a30423ff6
SHA512 93ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a
SSDEEP 12288:pvRneDBcP5s/UdTEQa8DOmJRJmILwCHEA188KijZZLr0X+c/d2zlNRTSTNo7I8:phe4kRQa8DO6JmJCvrKimZ4zlNRTST38
TLSH
T1D955F969F97C4176E121D4BFD183DA4AD1B230422B305AE74262CF6E1E3F5D6A13A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e585c83.msi

Path C:\Windows\Installer\e585c83.msi
Size 2.9MB
SHA256 8f424f4d327cb1032a0d6679d6d42ac44614131ecabd544244d03808c8b32e30
MD5 57615643093558c917c266d72bdc4121
SHA1 577694e2e017d726b8043e9badaa525407c539b3
SHA512 b1ba8294e8ff08c1289319e4c587fdea930350997979d7477fb9b397130bda164dad31d7d07eee7bd3ffac61f0c3e379a716571da4c7aa76157ec85651b1581c
SSDEEP 49152:bJrROW2qZLSv2c5Xq//eirNPmaxKWnfKtI4yhFmL2+v4vs3hWSN:bJrROWfLSv2tnt3c6BzhFmFwWhW
TLSH
T18BD533629F5C0660E80741B00B4FD6254DA9FD81DF5083598D83B6989A3E7FCBFBA097
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 ae37aff9e9cb1988331eab4acef560205528cbf28c9f7bfa0b29985c4d8537bf
MD5 a2b9ff9deaac64876ebdd3484d0cab26
SHA1 1b9e92d7c1ed376932cce9012765a327aa3ccb0e
SHA512 a237d69e95aaf0076d104bc2efbf9b72b05c4be00e2bc970b67b1d8c759f6403ef49d9923cf9c30498d241f2b993b23203e2ee752a3e64c504b47a3150a7bf48
SSDEEP 24576:g2gmSp1PdoO/vvTL5GSOh0nq/6p5Q4242WhdXJkC7J6oEeGHI5TVrPI1h:e
TLSH
T19C47A42436F92100E7F79E3D78F06A27493A7D5B9C15DE8D45411B8E0921BB0E8B2F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{edbcc02a-f2c9-440f-92cb-588156bff828}_OnDiskSnapshotProp

Path \??\Volume{731567b7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{edbcc02a-f2c9-440f-92cb-588156bff828}_OnDiskSnapshotProp
Size 6KB
SHA256 b9a7e7d6527501bb72c6008c69aeffb961345fa3e978acadcd4e6f1562cf19e2
MD5 6bf60b77d7bc60f60d6fc64ca30ad52b
SHA1 5b2d0e3574267e7675785e4042ee15691b9f0294
SHA512 e0ade7aaff910ef7f14797f1b8b90c5e54a197e47f0292350501dd3823e8299cd7b3037da5fe3701a4ef8ed79883d3e269feb861eac124c83ad0cf7f3b1596f9
SSDEEP 96:FxdmHUvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Rvb++ZVmN
TLSH
T107D18A185AF54711E2B3AB3229F14557A477B811EF33CB8E0198638E2670914F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3452-97-0x0000000002EA0000-0x000000000364E000-memory.dmp

Download

memory/3452-98-0x0000000002EA0000-0x000000000364E000-memory.dmp

Download

memory/3452-44-0x0000000002EA0000-0x000000000364E000-memory.dmp

Download