Overview
overview
5Static
static
3BDCAMSETUP...85.exe
windows7-x64
5BDCAMSETUP...85.exe
windows10-2004-x64
5$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$SYSDIR/D3...47.dll
windows10-2004-x64
3$SYSDIR/vcomp140.dll
windows7-x64
3$SYSDIR/vcomp140.dll
windows10-2004-x64
3$TEMP/BDMP...UP.exe
windows7-x64
5$TEMP/BDMP...UP.exe
windows10-2004-x64
5$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$SYSDIR/bdmjpeg.dll
windows7-x64
3$SYSDIR/bdmjpeg.dll
windows10-2004-x64
3$SYSDIR/bdmjpeg64.dll
windows7-x64
1$SYSDIR/bdmjpeg64.dll
windows10-2004-x64
1$SYSDIR/bdmpega.dll
windows7-x64
3$SYSDIR/bdmpega.dll
windows10-2004-x64
3$SYSDIR/bdmpega64.dll
windows7-x64
1$SYSDIR/bdmpega64.dll
windows10-2004-x64
1$SYSDIR/bdmpegv.dll
windows7-x64
3$SYSDIR/bdmpegv.dll
windows10-2004-x64
3RegVulkanLayer.bat
windows7-x64
3RegVulkanLayer.bat
windows10-2004-x64
3UnregVulkanLayer.bat
windows7-x64
3UnregVulkanLayer.bat
windows10-2004-x64
3amf-compon...32.dll
windows7-x64
3Analysis
-
max time kernel
94s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 11:50 UTC
Static task
static1
Behavioral task
behavioral1
Sample
BDCAMSETUP_ENG_4_1_2_1385.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
BDCAMSETUP_ENG_4_1_2_1385.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$SYSDIR/D3DCompiler_47.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
$SYSDIR/vcomp140.dll
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
$SYSDIR/vcomp140.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
$TEMP/BDMPEG1SETUP.exe
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
$TEMP/BDMPEG1SETUP.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20241010-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240903-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
$SYSDIR/bdmjpeg.dll
Resource
win7-20240708-en
Behavioral task
behavioral19
Sample
$SYSDIR/bdmjpeg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
$SYSDIR/bdmjpeg64.dll
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
$SYSDIR/bdmjpeg64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
$SYSDIR/bdmpega.dll
Resource
win7-20240708-en
Behavioral task
behavioral23
Sample
$SYSDIR/bdmpega.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
$SYSDIR/bdmpega64.dll
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
$SYSDIR/bdmpega64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
$SYSDIR/bdmpegv.dll
Resource
win7-20241010-en
Behavioral task
behavioral27
Sample
$SYSDIR/bdmpegv.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
RegVulkanLayer.bat
Resource
win7-20240708-en
Behavioral task
behavioral29
Sample
RegVulkanLayer.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
UnregVulkanLayer.bat
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
UnregVulkanLayer.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
amf-component-vce-windesktop32.dll
Resource
win7-20241010-en
General
-
Target
$SYSDIR/bdmpega.dll
-
Size
69KB
-
MD5
9b3c54a9c49ca00f5a9da7c7f84a57f9
-
SHA1
3fb1409da3e1f87eb4fd35cbd92549f3962f5304
-
SHA256
940cfe50336b7865787ee94a7292aa9e38f4ec8714ae06e2969b76b473834cc2
-
SHA512
48c7a129ae02a4ea4f2ebb4b8e28b8eaccfcfb37a5fd9b51aec868b45d630e585bd73018225dbbdb1a6fa66382db0420f8f9f8e88efa5149b20f2c5ae1407552
-
SSDEEP
1536:WSnI0PYUuguZ707dBDUtatRc3AV+jV+m2P:WkI6h7BDUtatRcQV+jV+m2P
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4964 wrote to memory of 2720 4964 rundll32.exe 85 PID 4964 wrote to memory of 2720 4964 rundll32.exe 85 PID 4964 wrote to memory of 2720 4964 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\bdmpega.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$SYSDIR\bdmpega.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2720
-
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.ax-0001.ax-msedge.netg-bing-com.ax-0001.ax-msedge.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.28.10ax-0001.ax-msedge.netIN A150.171.27.10
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0c4c5696dda248db862265e793ec39e8&localId=w:9BCA5FC4-E20E-516F-AAFA-89790EBA48FA&deviceId=6966572652123934&anid=Remote address:150.171.28.10:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0c4c5696dda248db862265e793ec39e8&localId=w:9BCA5FC4-E20E-516F-AAFA-89790EBA48FA&deviceId=6966572652123934&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=1598129912156D6C2D50078E13D76C24; domain=.bing.com; expires=Fri, 07-Nov-2025 11:50:49 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 74979B92FF0444B1BF20E8DE89D2F0A4 Ref B: LON601060105011 Ref C: 2024-10-13T11:50:49Z
date: Sun, 13 Oct 2024 11:50:48 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0c4c5696dda248db862265e793ec39e8&localId=w:9BCA5FC4-E20E-516F-AAFA-89790EBA48FA&deviceId=6966572652123934&anid=Remote address:150.171.28.10:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0c4c5696dda248db862265e793ec39e8&localId=w:9BCA5FC4-E20E-516F-AAFA-89790EBA48FA&deviceId=6966572652123934&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1598129912156D6C2D50078E13D76C24
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=tRx6_icWhiH3YtOLu71YQqRsbCZII18p--sNHga8Dz4; domain=.bing.com; expires=Fri, 07-Nov-2025 11:50:49 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0394BA38265447458A591F07FD80B0C9 Ref B: LON601060105011 Ref C: 2024-10-13T11:50:49Z
date: Sun, 13 Oct 2024 11:50:48 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0c4c5696dda248db862265e793ec39e8&localId=w:9BCA5FC4-E20E-516F-AAFA-89790EBA48FA&deviceId=6966572652123934&anid=Remote address:150.171.28.10:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0c4c5696dda248db862265e793ec39e8&localId=w:9BCA5FC4-E20E-516F-AAFA-89790EBA48FA&deviceId=6966572652123934&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1598129912156D6C2D50078E13D76C24; MSPTC=tRx6_icWhiH3YtOLu71YQqRsbCZII18p--sNHga8Dz4
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 98ACC8864C8642D1BA72BA5D470CAA7A Ref B: LON601060105011 Ref C: 2024-10-13T11:50:49Z
date: Sun, 13 Oct 2024 11:50:48 GMT
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.42.69.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request23.236.111.52.in-addr.arpaIN PTRResponse
-
150.171.28.10:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0c4c5696dda248db862265e793ec39e8&localId=w:9BCA5FC4-E20E-516F-AAFA-89790EBA48FA&deviceId=6966572652123934&anid=tls, http22.0kB 9.4kB 22 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0c4c5696dda248db862265e793ec39e8&localId=w:9BCA5FC4-E20E-516F-AAFA-89790EBA48FA&deviceId=6966572652123934&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0c4c5696dda248db862265e793ec39e8&localId=w:9BCA5FC4-E20E-516F-AAFA-89790EBA48FA&deviceId=6966572652123934&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0c4c5696dda248db862265e793ec39e8&localId=w:9BCA5FC4-E20E-516F-AAFA-89790EBA48FA&deviceId=6966572652123934&anid=HTTP Response
204
-
56 B 148 B 1 1
DNS Request
g.bing.com
DNS Response
150.171.28.10150.171.27.10
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
140.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
241.42.69.40.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
23.236.111.52.in-addr.arpa