Analysis
- user interaction
yes - max time kernel
142s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
27/07/2026, 09:26
General
- Target TunnelBear-Installer.exe
- Size 180.3MB
- Sample260727-lemlyscm4s
- SHA256 37448f91344a2cec36b6d515e308279cc313d22f16033f55d78cb4c6b094404a
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TunnelBear-Installer.exe"C:\Users\Admin\AppData\Local\Temp\TunnelBear-Installer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\{9950E9C7-02E7-4ECD-869C-B64F2F31221C}\.cr\TunnelBear-Installer.exe"C:\Windows\TEMP\{9950E9C7-02E7-4ECD-869C-B64F2F31221C}\.cr\TunnelBear-Installer.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\TunnelBear-Installer.exe" -burn.filehandle.attached=776 -burn.filehandle.self=7802⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\TEMP\{802459A6-FE21-4E16-A42A-B1556F9DECEC}\.ba\Wix4NetfxBundleExtension_X86\x86\netcoresearch.exe"C:\Windows\TEMP\{802459A6-FE21-4E16-A42A-B1556F9DECEC}\.ba\Wix4NetfxBundleExtension_X86\x86\netcoresearch.exe" runtime 8 Microsoft.AspNetCore.App3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Time Discovery
-
-
C:\Windows\TEMP\{802459A6-FE21-4E16-A42A-B1556F9DECEC}\.ba\Wix4NetfxBundleExtension_X86\x86\netcoresearch.exe"C:\Windows\TEMP\{802459A6-FE21-4E16-A42A-B1556F9DECEC}\.ba\Wix4NetfxBundleExtension_X86\x86\netcoresearch.exe" runtime 8 Microsoft.WindowsDesktop.App3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
TunnelBear_Installer_639207449217516213.log
TunnelBear.Installer.UI.exe
netfxbe.dll
hostfxr.dll
netcoresearch.exe
WixToolset.Mba.Core.dll
WixToolset.Mba.Host.config
WixToolset.Mba.Host.dll
mbahost.dll
mbanative.dll
TunnelBear-Installer.exe
memory/6060-74-0x0000000003D70000-0x0000000003D9C000-memory.dmp
memory/6060-105-0x0000000011560000-0x0000000011568000-memory.dmp
memory/6060-76-0x0000000073FC0000-0x000000007477C000-memory.dmp
memory/6060-70-0x00000000036C0000-0x00000000036CA000-memory.dmp
memory/6060-87-0x0000000073FC0000-0x000000007477C000-memory.dmp
memory/6060-66-0x0000000073FC0000-0x000000007477C000-memory.dmp
memory/6060-65-0x0000000073FC0000-0x000000007477C000-memory.dmp
memory/6060-62-0x0000000073FD2000-0x0000000073FD3000-memory.dmp
memory/6060-102-0x0000000073FC0000-0x000000007477C000-memory.dmp
memory/6060-103-0x0000000007650000-0x000000000770A000-memory.dmp
memory/6060-104-0x00000000075C0000-0x00000000075DC000-memory.dmp
memory/6060-81-0x00000000063E0000-0x000000000680A000-memory.dmp
memory/6060-106-0x0000000073FC0000-0x000000007477C000-memory.dmp
memory/6060-108-0x0000000011FC0000-0x0000000011FCE000-memory.dmp
memory/6060-107-0x0000000011FE0000-0x000000001201E000-memory.dmp
memory/6060-111-0x0000000013000000-0x0000000013008000-memory.dmp
memory/6060-112-0x0000000073FD2000-0x0000000073FD3000-memory.dmp
memory/6060-113-0x0000000073FC0000-0x000000007477C000-memory.dmp
memory/6060-114-0x0000000073FC0000-0x000000007477C000-memory.dmp
memory/6060-115-0x0000000073FC0000-0x000000007477C000-memory.dmp
memory/6060-116-0x0000000073FC0000-0x000000007477C000-memory.dmp