Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
29-10-2024 10:04
Behavioral task
behavioral1
Sample
02b3757b29002a8fcabd9afaebf1f7d3.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
02b3757b29002a8fcabd9afaebf1f7d3.exe
Resource
win10v2004-20241007-en
General
-
Target
02b3757b29002a8fcabd9afaebf1f7d3.exe
-
Size
68KB
-
MD5
02b3757b29002a8fcabd9afaebf1f7d3
-
SHA1
cecffd787a418e435a9019211dda54444c2184fd
-
SHA256
e909609bcd7d6a217635b372abba6e55d034d2e55712b032844ce28ded020064
-
SHA512
fa7312829ddb66c4e3dba341eb45b2625c45060cfb2265a53ddb54595dd28d9245959eee6065b50e58d1908660732785a0430ae9345455d4bbcefd52fc5b015a
-
SSDEEP
1536:sb1MsHz3JDwhyWr+N95OTga6S+PGCq2iW7z:XsT3JezcMCSkGCH
Malware Config
Extracted
runningrat
119.91.152.151
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2344-51-0x0000000000ED0000-0x0000000000ED9000-memory.dmp family_bdaejec_backdoor -
RunningRat
RunningRat is a remote access trojan first seen in 2018.
-
RunningRat payload 1 IoCs
resource yara_rule behavioral1/memory/2136-0-0x0000000000400000-0x0000000000411000-memory.dmp family_runningrat -
Runningrat family
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SySyeu\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259445215.dll" 02b3757b29002a8fcabd9afaebf1f7d3.exe -
resource yara_rule behavioral1/files/0x000a0000000122d0-4.dat aspack_v212_v242 -
Deletes itself 1 IoCs
pid Process 2832 cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 2344 XekSuT.exe 2656 SySyeu.exe -
Loads dropped DLL 9 IoCs
pid Process 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe 2736 svchost.exe 2736 svchost.exe 2656 SySyeu.exe 2656 SySyeu.exe 2656 SySyeu.exe 2656 SySyeu.exe -
Creates a Windows Service
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\SySyeu.exe svchost.exe File opened for modification C:\Windows\SysWOW64\SySyeu.exe svchost.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe XekSuT.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE XekSuT.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe XekSuT.exe File opened for modification C:\Program Files\7-Zip\7z.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe XekSuT.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe XekSuT.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe XekSuT.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe XekSuT.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe XekSuT.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe XekSuT.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe XekSuT.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE XekSuT.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe XekSuT.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe XekSuT.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe XekSuT.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE XekSuT.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe XekSuT.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe XekSuT.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe XekSuT.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe XekSuT.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE XekSuT.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe XekSuT.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe XekSuT.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe XekSuT.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe XekSuT.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE XekSuT.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe XekSuT.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe XekSuT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02b3757b29002a8fcabd9afaebf1f7d3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XekSuT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SySyeu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2832 cmd.exe 2780 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2780 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2344 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe 30 PID 2136 wrote to memory of 2344 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe 30 PID 2136 wrote to memory of 2344 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe 30 PID 2136 wrote to memory of 2344 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe 30 PID 2136 wrote to memory of 2832 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe 33 PID 2136 wrote to memory of 2832 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe 33 PID 2136 wrote to memory of 2832 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe 33 PID 2136 wrote to memory of 2832 2136 02b3757b29002a8fcabd9afaebf1f7d3.exe 33 PID 2832 wrote to memory of 2780 2832 cmd.exe 35 PID 2832 wrote to memory of 2780 2832 cmd.exe 35 PID 2832 wrote to memory of 2780 2832 cmd.exe 35 PID 2832 wrote to memory of 2780 2832 cmd.exe 35 PID 2736 wrote to memory of 2656 2736 svchost.exe 38 PID 2736 wrote to memory of 2656 2736 svchost.exe 38 PID 2736 wrote to memory of 2656 2736 svchost.exe 38 PID 2736 wrote to memory of 2656 2736 svchost.exe 38 PID 2344 wrote to memory of 684 2344 XekSuT.exe 39 PID 2344 wrote to memory of 684 2344 XekSuT.exe 39 PID 2344 wrote to memory of 684 2344 XekSuT.exe 39 PID 2344 wrote to memory of 684 2344 XekSuT.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\02b3757b29002a8fcabd9afaebf1f7d3.exe"C:\Users\Admin\AppData\Local\Temp\02b3757b29002a8fcabd9afaebf1f7d3.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\XekSuT.exeC:\Users\Admin\AppData\Local\Temp\XekSuT.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\5a814430.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:684
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\02b3757b29002a8fcabd9afaebf1f7d3.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2780
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "SySyeu"1⤵PID:2248
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "SySyeu"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\SySyeu.exeC:\Windows\system32\SySyeu.exe "c:\users\admin\appdata\local\temp\259445215.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD592811d64fb59d90a6c719b68782c9225
SHA14ae4613929f35421f4eee3faa5cfff74c3c0cb42
SHA2569aff4064f8dbf6b078ee2c698435e125b937b943faea02dd2b2725bdcc9e0db5
SHA5126f2e0cec29f16024ddeb079323570d69f0909b2a0dae5e40c35f517b2f22722daa87e19399466d8cc605cdf73b31f654b858e9b0ff3e4f7f60b7aa4e6255bab0
-
Filesize
4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
Filesize
25KB
MD5db598538e7a70b73298f6424ae507e02
SHA1d06a04fb9ca1bb8da5974870196ae5c0eadc1fa9
SHA256cc4ab82995b0c0c827e99870948ef6a1371d4d1ed6d167a087c0d5c123d0f15e
SHA512ebedb94e2ba77836317596557fb447e6abc78fecfafce8de900d70202994fe829459665e0dec8813c51039b64a12d08258bc6074324b729994b61e8467f5e3fa
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e