Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
08-11-2024 03:30
General
-
Target
b3e4b1be3d6271f8a68b21809b3b8acaeb5a80541a79944f2f466b61109d059c.exe
-
Size
11.5MB
-
MD5
2213447d6a5b56dbbcce43b7e3a6e641
-
SHA1
f0bbf609b5c3182a17a6a5878283e025b23f233f
-
SHA256
b3e4b1be3d6271f8a68b21809b3b8acaeb5a80541a79944f2f466b61109d059c
-
SHA512
d229231148dfe8509272f2c7f4eeb3c7b4e5edeb9fa652989b06ffb2621244af438939d3cf166d24c0f5f5ab14585adf95d738a32dfa4886ce5502dd4370006d
-
SSDEEP
196608:FAQuVH3M82sRhWphk2XmH24Wgf7TInXinHuE50PbdtwsmrKVveZleGxzLVyyqg:GLxM8r22PvInXinHuK0xCKVvetRVl
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec
Bdaejec is a backdoor written in C++.
-
Bdaejec family
-
Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Themida packer 19 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3e4b1be3d6271f8a68b21809b3b8acaeb5a80541a79944f2f466b61109d059c.exe"C:\Users\Admin\AppData\Local\Temp\b3e4b1be3d6271f8a68b21809b3b8acaeb5a80541a79944f2f466b61109d059c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nBkKZr.exeC:\Users\Admin\AppData\Local\Temp\nBkKZr.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\43ae54fe.bat" "3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
187B
MD5347444adfd7755663dd71a9e9da6ea1b
SHA1019f15893947b952c54d92d57ac4cea48d550941
SHA2566a438793c6c1804dbfd166055f830477db03ea3a110102876eec1a67c9da2954
SHA5127c500cbee8ec00648c3694c0dc04539a9402976ae27d4507ac85e8b58f7b087dd6908d606c0553415422b47039e0864954cef89802ed08bc75b182587c27ca51
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
1.1MB
-
Filesize
18.9MB
-
Filesize
8KB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
18.9MB
-
Filesize
36KB
-
Filesize
36KB