Overview

overview

10

Static

static

1

tmp2sxmmvx8.msi

windows10-ltsc_2021-x64

10

tmp2sxmmvx8.msi

windows10-2004-x64

10

tmp2sxmmvx8.msi

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    09/06/2026, 01:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmp2sxmmvx8.msi
  • Size 9.5MB
  • Sample260609-bd5q2aas2v
  • SHA256 1ba85af9be3e263befdaac86084f96b014684c8d3a85d0572ca1113e52a4fa4d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
grp666discoverybumblebeeloaderpersistenceprivilege_escalationransomware

Malware Config

Extracted

Family

  • bumblebee

Botnet

  • grp666

Attributes
  • dga

    ev2sirbd269o5j.org

    ijt0l3i8brit6q.org

    ewujsfb1dp5ran.org

    8doj8uvx604eck.org

    kwywztxoo2xdot.org

    2rxyt9urhq0bgj.org

    ky1d1p1daahe5t.org

    ovh1kn1tcqw5kp.org

    6cimu4mc085em8.org

    5ka8rxp6t6eup2.org

    ks50ioz9nm3v05.org

    v5rjsdqogstopr.org

    epnl524h4k03mu.org

    hpzmehtnkk4q22.org

    ygvmhd7ll9v2nu.org

    oovlcxvht9kupu.org

    1074slp8zafyz3.org

    vfwlzltibeg7ne.org

    wp67lr8ysypurn.org

    1ge03xy5vtwn5s.org

    958xz3300iu8oe.org

    dlbqduy9gjprko.org

    tycl4o5dep10cd.org

    ui9bex45gw70az.org

    trj1qy559ygvx3.org

    w823niq7veztr9.org

    01t05hb4armbco.org

    igl71zhw25qw3d.org

    j8ku0xu0dqduxr.org

    jy3y61q6hyhf4c.org

  • dga_seed

    4792266342353752649

  • domain_length

    14

  • num_dga_domains

    300

  • port

    443

  • tld

    .org

rc4.plain

Signatures

  • Family: BumbleBee

    BumbleBee is a loader malware written in C++.

    loaderbumblebee
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Badlisted process makes network request 10 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 32 IoCs
  • Drops file in Windows directory 37 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 18 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tmp2sxmmvx8.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2984
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1748
      • C:\Windows\system32\msiexec.exe
        msiexec /i "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\rvtools4.7.1.msi"
        2⤵
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious use of FindShellTrayWindow
        PID:1672
      • C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
        "C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3328
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding D013A05490F22804B1A1C46562B3AE0D C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        PID:2204
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 8B9D2503CCF0B19DC4FB42FB5DE7621D E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4320
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3588

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e58fb83.rbs
          • Path C:\Config.Msi\e58fb83.rbs
          • Size 7KB
          • SHA256 9567878d1463c6c09c9eb57e5384d2020ce1f247d206c05ee5d3c976aadfe876
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e58fb86.rbs
          • Path C:\Config.Msi\e58fb86.rbs
          • Size 19KB
          • SHA256 df4ab5da57840a4789f7120ac5d728e6d6a58c514a89356f037c306dbd3ed7ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          357F04AD41BCF5FE18FCB69F60C6680F_BC7BC920A8A1480E3C9FBCE6EF3CE34E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_BC7BC920A8A1480E3C9FBCE6EF3CE34E
          • Size 1KB
          • SHA256 a34b09aa56cbfafcb8c42dc0fb1ff0558b32da695a05032ebf30029d3c411725
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Size 1KB
          • SHA256 0e463db8726b9ec19b1770d5790ea4727af39c85b4d951f56b7cb00b639816d9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          357F04AD41BCF5FE18FCB69F60C6680F_BC7BC920A8A1480E3C9FBCE6EF3CE34E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_BC7BC920A8A1480E3C9FBCE6EF3CE34E
          • Size 540B
          • SHA256 d7ecc18eeab1c9d5ac45aaac80e93518d17f4b631e2836071c26345b7a799a45
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
          • Size 536B
          • SHA256 6809ea9adf31e9298558af7e8b7184dce2e74ffb4726168ddbb262062abedf67
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          consent.exe
          • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\consent.exe
          • Size 109KB
          • SHA256 ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msimg32.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\msimg32.dll
          • Size 2.9MB
          • SHA256 cb3fbd2300fa14e97d3fb6728014b4821c9018e2422776b62d1d87407edcd0d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          rvtools4.7.1.msi
          • Path C:\Users\Admin\AppData\Local\Temp\ApplicationInstallationFolder_11\rvtools4.7.1.msi
          • Size 8.0MB
          • SHA256 0506126bcbc4641d41c138e88d9ea9f10fb65f1eeab3bff90ad25330108b324c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e58fb82.msi
          • Path C:\Windows\Installer\e58fb82.msi
          • Size 9.5MB
          • SHA256 1ba85af9be3e263befdaac86084f96b014684c8d3a85d0572ca1113e52a4fa4d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIFEAE.tmp
          • Path C:\Windows\SystemTemp\MSIFEAE.tmp
          • Size 285KB
          • SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 24.6MB
          • SHA256 f3dc10d8e2c3bdb20efec61bca41993d4a78a07985b95e12c0680337b739abb8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {1db42105-d878-46d8-906c-ec238886266d}_OnDiskSnapshotProp
          • Path \??\Volume{a56ea927-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1db42105-d878-46d8-906c-ec238886266d}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 aea4dc99a5950b8b08325475917d1ce4e1743c2fe5db77abee8b11350377142c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3328-53-0x0000000002DE0000-0x000000000358E000-memory.dmp
          Download

          memory/3328-59-0x0000000002DE0000-0x000000000358E000-memory.dmp
          Download