If the formal rules are:
"Numbers >= 4 AND characters == 1"
you'll find no way with regex because the character could be everywhere. In this case you'd need some kind of Pushdown automaton or an algorithm with a counter.
If the rule is
"Numbers == 4 AND characters == 1"
the following should (not easy to read) may work:
([a-zA-Z][0-9]{4,})|([0-9][a-zA-Z][0-9]{3,})|([0-9]{2,}[a-zA-Z][0-9]{2,})|([0-9]{3,}[a-zA-Z][0-9])|([0-9]{4,}[a-zA-Z])
And if the ruls is
"(Numbers + characters) >= 4 AND characters >= 1" this may work:
([a-zA-Z]([a-zA-Z]|[0-9]){4,})|(([a-zA-Z]|[0-9])[a-zA-Z]([a-zA-Z]|[0-9]){3,})|(([a-zA-Z]|[0-9]){2,}[a-zA-Z]([a-zA-Z]|[0-9]){2,})|(([a-zA-Z]|[0-9]){3,}[a-zA-Z]([a-zA-Z]|[0-9]))|(([a-zA-Z]|[0-9]){4,}[a-zA-Z])
But because of bot solutions are quite ugly I'd suggest to use none of them. Implement a small algorithm would be easier and more readable.