Overview

overview

10

Static

static

1

tmp2sxmmvx8.msi

windows10-ltsc_2021-x64

10

tmp2sxmmvx8.msi

windows10-2004-x64

10

tmp2sxmmvx8.msi

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/06/2026, 01:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmp2sxmmvx8.msi
  • Size 9.5MB
  • Sample260609-bd5q2aas2v
  • SHA256 1ba85af9be3e263befdaac86084f96b014684c8d3a85d0572ca1113e52a4fa4d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
grp666discoverybumblebeeloaderpersistenceprivilege_escalationransomware

Malware Config

Extracted

Family

  • bumblebee

Botnet

  • grp666

Attributes
  • dga

    ev2sirbd269o5j.org

    ijt0l3i8brit6q.org

    ewujsfb1dp5ran.org

    8doj8uvx604eck.org

    kwywztxoo2xdot.org

    2rxyt9urhq0bgj.org

    ky1d1p1daahe5t.org

    ovh1kn1tcqw5kp.org

    6cimu4mc085em8.org

    5ka8rxp6t6eup2.org

    ks50ioz9nm3v05.org

    v5rjsdqogstopr.org

    epnl524h4k03mu.org

    hpzmehtnkk4q22.org

    ygvmhd7ll9v2nu.org

    oovlcxvht9kupu.org

    1074slp8zafyz3.org

    vfwlzltibeg7ne.org

    wp67lr8ysypurn.org

    1ge03xy5vtwn5s.org

    958xz3300iu8oe.org

    dlbqduy9gjprko.org

    tycl4o5dep10cd.org

    ui9bex45gw70az.org

    trj1qy559ygvx3.org

    w823niq7veztr9.org

    01t05hb4armbco.org

    igl71zhw25qw3d.org

    j8ku0xu0dqduxr.org

    jy3y61q6hyhf4c.org

  • dga_seed

    4792266342353752649

  • domain_length

    14

  • num_dga_domains

    300

  • port

    443

  • tld

    .org

rc4.plain

Signatures

  • Family: BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Badlisted process makes network request 6 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 32 IoCs
  • Drops file in Windows directory 19 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 18 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp2sxmmvx8.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:5428
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4176
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4988
    • C:\Windows\system32\msiexec.exe
      msiexec /i "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\rvtools4.7.1.msi"
      2⤵
      • Enumerates connected drives
      • Suspicious use of FindShellTrayWindow
      PID:924
    • C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
      "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2288
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7CF0F7C1510B62ED28A8118F52C9D1ED C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      PID:2160
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F498E65EB0A377821D5056422E3E7840 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4756
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3552

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e586e56.rbs
        • Path C:\Config.Msi\e586e56.rbs
        • Size 7KB
        • SHA256 84fb16068653a11754db17b88ecebb41442b9429cceb3800dae9ed2593c8c845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e586e59.rbs
        • Path C:\Config.Msi\e586e59.rbs
        • Size 19KB
        • SHA256 befe3e492efc078154088632c93b97e741ec513a29d9ca91f537ddd9cdd81239
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        357F04AD41BCF5FE18FCB69F60C6680F_BC7BC920A8A1480E3C9FBCE6EF3CE34E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_BC7BC920A8A1480E3C9FBCE6EF3CE34E
        • Size 1KB
        • SHA256 a34b09aa56cbfafcb8c42dc0fb1ff0558b32da695a05032ebf30029d3c411725
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
        • Size 1KB
        • SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        357F04AD41BCF5FE18FCB69F60C6680F_BC7BC920A8A1480E3C9FBCE6EF3CE34E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_BC7BC920A8A1480E3C9FBCE6EF3CE34E
        • Size 540B
        • SHA256 2378a76707fa8d74cafd876794eb792028a1b90abfccddeaa26f27f4495573fb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
        • Size 536B
        • SHA256 b966d36c6a59f722a88f43fc931e47de033af1053d5ef25e2acd2e4e848c20a3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        consent.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
        • Size 109KB
        • SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msimg32.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\msimg32.dll
        • Size 2.9MB
        • SHA256 cb3fbd2300fa14e97d3fb6728014b4821c9018e2422776b62d1d87407edcd0d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rvtools4.7.1.msi
        • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\rvtools4.7.1.msi
        • Size 8.0MB
        • SHA256 0506126bcbc4641d41c138e88d9ea9f10fb65f1eeab3bff90ad25330108b324c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI7376.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSI7376.tmp
        • Size 285KB
        • SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e586e55.msi
        • Path C:\Windows\Installer\e586e55.msi
        • Size 9.5MB
        • SHA256 1ba85af9be3e263befdaac86084f96b014684c8d3a85d0572ca1113e52a4fa4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 24.1MB
        • SHA256 f686813a3b9ef88c7ff3f5edd6e487c73da7bae7a950320560c08459e987b399
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {ccc43c7b-5a47-4315-965b-526c5f21d301}_OnDiskSnapshotProp
        • Path \??\Volume{12d9ef41-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ccc43c7b-5a47-4315-965b-526c5f21d301}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 ab0c90390603f9026a8232010f1ca0b70ddc2e3d220165c72d00b7685a3716f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2288-43-0x0000000002DB0000-0x00000000034EF000-memory.dmp
        Download

        memory/2288-56-0x0000000002DB0000-0x00000000034EF000-memory.dmp
        Download

        memory/2288-57-0x0000000002DB0000-0x00000000034EF000-memory.dmp
        Download