Analysis date (UTC): 20 May 2025, 10:30Analysis environment: Windows 10 Pro, build 19044, x64

RVTools.msi

MD5:81684639C9276254F15F8777B9A63BD5

SHA1:188A9815F13A97803B76865941B687C21D0E9B4E

SHA256:A67BAE3DD73789E892B5114A157D992424D367AAE11C5FBAA80BE639D6DEC798

Analysis result

Threat level:Malicious activity

Tags:

generated-docphishing

Full analysis:Analysis RVTools.msi (MD5: 81684639C9276254F15F8777B9A63BD5) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Executing a file with an untrusted certificate

icardagt.exe (PID: 6964)

Connects to the CnC server

icardagt.exe (PID: 6964)

SUSPICIOUS

Process drops legitimate windows executable

msiexec.exe (PID: 7416)
msiexec.exe (PID: 7504)

Executes as Windows Service

VSSVC.exe (PID: 7600)

Application launched itself

msiexec.exe (PID: 7504)

Starts a Microsoft application from unusual location

icardagt.exe (PID: 6964)

Contacting a server suspected of hosting an CnC

icardagt.exe (PID: 6964)

INFO

The sample compiled with english language support

msiexec.exe (PID: 7416)
msiexec.exe (PID: 7504)
msiexec.exe (PID: 4776)

Creates files or folders in the user directory

msiexec.exe (PID: 7416)

Reads the computer name

msiexec.exe (PID: 7504)

Reads security settings of Internet Explorer

msiexec.exe (PID: 7416)

Checks supported languages

msiexec.exe (PID: 7504)

Reads the software policy settings

msiexec.exe (PID: 7416)

The sample compiled with polish language support

msiexec.exe (PID: 7504)

Manages system restore points

SrTasks.exe (PID: 8028)
SrTasks.exe (PID: 680)

Executable content was dropped or overwritten

msiexec.exe (PID: 7504)
msiexec.exe (PID: 4776)

Manual execution by a user

msedge.exe (PID: 5756)
msedge.exe (PID: 7276)
msedge.exe (PID: 4408)
msedge.exe (PID: 4056)
msedge.exe (PID: 7688)

Application launched itself

msedge.exe (PID: 5756)

Threats

PID	Process	Class	Message
—	—	Malware Command and Control Activity Detected	ET MALWARE BumbleBee Loader CnC Checkin
6964	icardagt.exe	Malware Command and Control Activity Detected	ET MALWARE BumbleBee Loader CnC Checkin
8040	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
8040	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
8040	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
8040	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
8040	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
8040	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
8040	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
8040	msedge.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)

Rows per page