File name:

file

Full analysis: https://app.any.run/tasks/101e6331-ef03-4e78-856b-342f3b8b459c
Verdict: Malicious activity
Threats:

Bumblebee is a highly adaptable malware loader, often used by threat actors linked to the Conti and TrickBot cybercrime groups. Since its discovery in 2021, Bumblebee has been leveraged in phishing campaigns and email thread hijacking, primarily to distribute payloads like Cobalt Strike and ransomware. The malware employs obfuscation techniques, such as DLL injection and virtual environment detection, to avoid detection and sandbox analysis. Its command-and-control infrastructure and anti-analysis features allow it to persist on infected devices, where it enables further payload downloads and system compromise.

Malware Trends Tracker     >>>
Analysis date: November 25, 2023, 21:32:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
bumblebee
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4A657CF9C1289E3DF987268E32961A66

SHA1:

77167BA7C7ADB768BA4A1A0D561A8828E73F5035

SHA256:

4203F929FE8FAB1C990E027216EF732955CC4FBFE598E9DC02DBF61FEFD2E579

SSDEEP:

98304:BO7UY7BGRmoqWseW/sygVXIGdPdAtatEeaju3Dvtpk16LWXId+QpksbzFr9daYV6:uYxTvc5DL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • file.exe (PID: 1420)
      • msiexec.exe (PID: 2844)

    • Connects to the CnC server

      • msiexec.exe (PID: 2068)

    • BUMBLEBEE has been detected (YARA)

      • msiexec.exe (PID: 2068)

  • SUSPICIOUS

    • Checks Windows Trust Settings

      • file.exe (PID: 1420)
      • msiexec.exe (PID: 2844)

    • Reads settings of System Certificates

      • file.exe (PID: 1420)

    • Reads security settings of Internet Explorer

      • file.exe (PID: 1420)

    • Reads the Internet Settings

      • file.exe (PID: 1420)

    • Reads the Windows owner or organization settings

      • file.exe (PID: 1420)

  • INFO

    • Creates files or folders in the user directory

      • file.exe (PID: 1420)

    • Reads the computer name

      • file.exe (PID: 1420)
      • msiexec.exe (PID: 2844)
      • msiexec.exe (PID: 2112)
      • msiexec.exe (PID: 1688)
      • msiexec.exe (PID: 2068)

    • Checks supported languages

      • file.exe (PID: 1420)
      • msiexec.exe (PID: 2844)
      • msiexec.exe (PID: 2112)
      • msiexec.exe (PID: 1688)
      • msiexec.exe (PID: 2068)

    • Reads the machine GUID from the registry

      • file.exe (PID: 1420)
      • msiexec.exe (PID: 2844)
      • msiexec.exe (PID: 2112)
      • msiexec.exe (PID: 1688)
      • msiexec.exe (PID: 2068)

    • Create files in a temporary directory

      • file.exe (PID: 1420)
      • msiexec.exe (PID: 2844)

    • Reads Environment values

      • file.exe (PID: 1420)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1652)

    • Application launched itself

      • msiexec.exe (PID: 2844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:15 14:33:00+01:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.37
CodeSize: 2604032
InitializedDataSize: 1085440
UninitializedDataSize: -
EntryPoint: 0x1f0aa6
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.5.2.3
ProductVersionNumber: 1.5.2.3
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: security update
FileDescription: security update Installer
FileVersion: 1.5.2.3
InternalName: security update
LegalCopyright: Copyright (C) 2023 security update
OriginalFileName: security update.exe
ProductName: security update
ProductVersion: 1.5.2.3
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start file.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs #BUMBLEBEE msiexec.exe

Process information

PID
CMD
Path
Indicators
Parent process
1420"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Company:
security update
Integrity Level:
MEDIUM
Description:
security update Installer
Exit code:
0
Version:
1.5.2.3
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1652"C:\Windows\system32\msiexec.exe" /i "C:\Users\admin\AppData\Roaming\security update\security update 1.5.2.3\install\A6B488A\security update.msi" AI_SETUPEXEPATH=C:\Users\admin\AppData\Local\Temp\file.exe SETUPEXEDIR=C:\Users\admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1700945929 " AI_EUIMSI=""C:\Windows\SysWOW64\msiexec.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1688C:\Windows\syswow64\MsiExec.exe -Embedding 9F00A9B271BAD076A14E2429185CA58DC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2068C:\Windows\system32\MsiExec.exe -Embedding 0E27CEA757ADB181F9A2B2AAC20F9ADCC:\Windows\System32\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2112C:\Windows\syswow64\MsiExec.exe -Embedding 81B6D0BBC9FA5231F1DB6E17818E2EFC CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2844C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
4 937
Read events
4 907
Write events
24
Delete events
6

Modification events

(PID) Process:(1420) file.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1652) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2844) msiexec.exeKey:HKEY_USERS\S-1-5-21-3896776584-4254864009-862391680-1000_CLASSES\Local Settings\MuiCache\15A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2844) msiexec.exeKey:HKEY_USERS\S-1-5-21-3896776584-4254864009-862391680-1000_CLASSES\Local Settings\MuiCache\15A\52C64B7E
Operation:delete keyName:(default)
Value:
(PID) Process:(2844) msiexec.exeKey:HKEY_USERS\S-1-5-21-3896776584-4254864009-862391680-1000_CLASSES\Local Settings\MuiCache\15A
Operation:delete keyName:(default)
Value:
(PID) Process:(2844) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:delete valueName:C:\Config.Msi\1f85b6.rbs
Value:
31072231
(PID) Process:(2844) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:delete valueName:C:\Config.Msi\1f85b6.rbsLow
Value:
4652624
(PID) Process:(2844) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:delete keyName:(default)
Value:
(PID) Process:(2844) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback
Operation:delete keyName:(default)
Value:
Executable files
7
Suspicious files
9
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1420file.exeC:\Users\admin\AppData\Roaming\security update\security update 1.5.2.3\install\A6B488A\security update.msi —
MD5:—
SHA256:—
2844msiexec.exeC:\Windows\Installer\1f85b3.msi —
MD5:—
SHA256:—
1420file.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:D261FBE3FBD5328CBDBAB403052E4DA5
SHA256:1F12C5DAEC8878F844E78D3737771E406B6352DEFB6BFBC78D807C57340B1F70
1420file.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1420file.exeC:\Users\admin\AppData\Local\Temp\MSI845F.tmpexecutable
MD5:5A1F2196056C0A06B79A77AE981C7761
SHA256:52F41817669AF7AC55B1516894EE705245C3148F2997FA0E6617E9CC6353E41E
1420file.exeC:\Users\admin\AppData\Local\Temp\Tar8343.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
1420file.exeC:\Users\admin\AppData\Local\Temp\Cab8342.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1420file.exeC:\Users\admin\AppData\Local\Temp\MSI8400.tmpexecutable
MD5:5A1F2196056C0A06B79A77AE981C7761
SHA256:52F41817669AF7AC55B1516894EE705245C3148F2997FA0E6617E9CC6353E41E
2844msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF09143DFBD048C6CA.TMPbinary
MD5:271E0F738C349EB781B01DBC39F2ECCB
SHA256:4BBAEDDB31BF28B826878FA20F7ABF9B83DCD72EE9ACCE78394C5E6692196081
2844msiexec.exeC:\Windows\Installer\MSI869E.tmpexecutable
MD5:5A1F2196056C0A06B79A77AE981C7761
SHA256:52F41817669AF7AC55B1516894EE705245C3148F2997FA0E6617E9CC6353E41E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
20
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1420
file.exe
GET
200
67.27.158.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?faac3d6aa1129a4e
unknown
compressed
61.6 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1420
file.exe
67.27.158.254:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
2068
msiexec.exe
85.17.31.82:443
n64c2akw.life
LeaseWeb Netherlands B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 67.27.158.254
  • 8.248.131.254
  • 8.248.149.254
  • 67.27.159.254
  • 67.26.137.254
whitelisted
n64c2akw.life
  • 5.79.71.205
  • 5.79.71.225
  • 85.17.31.82
  • 85.17.31.122
  • 178.162.203.202
  • 178.162.203.211
  • 178.162.203.226
  • 178.162.217.107
unknown
zefawfb0.life
  • 94.131.9.114
unknown
dph3pby8.life
  • 192.71.249.220
unknown
hx0hysyg.life
  • 185.248.144.178
unknown
1qa3k743.life
  • 85.17.31.82
  • 85.17.31.122
  • 178.162.203.202
  • 178.162.203.211
  • 178.162.203.226
  • 178.162.217.107
  • 5.79.71.205
  • 5.79.71.225
unknown
luw8ubf2.life
  • 85.17.31.82
  • 85.17.31.122
  • 178.162.203.202
  • 178.162.203.211
  • 178.162.203.226
  • 178.162.217.107
  • 5.79.71.205
  • 5.79.71.225
unknown
rbvsf6io.life
  • —
unknown
4huoqrsp.life
  • —
unknown
8qwcvseh.life
  • —
unknown

Threats

PID
Process
Class
Message
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .life TLD
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .life TLD
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .life TLD
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .life TLD
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .life TLD
2068
msiexec.exe
A Network Trojan was detected
ET MALWARE Win32/Bumblebee Loader Checkin Activity
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .life TLD
2068
msiexec.exe
A Network Trojan was detected
ET MALWARE Win32/Bumblebee Loader Checkin Activity
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .life TLD
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .life TLD
No debug info