Analysis
-
max time kernel
64s -
max time network
74s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 14:23
Static task
static1
1 signatures
General
-
Target
Gaming Chair.exe
-
Size
2.1MB
-
MD5
9503205a5f7581720f7fa6348c49a93b
-
SHA1
34453ec11bb30ae10519a468deaefbf3f965fe3a
-
SHA256
0dca41e17e4f286a420dd2e6fbbd9ad460f1dac1f3de83672fa9de977f6b6402
-
SHA512
0524cabf5d0b87bf6f34a1c2e2cc3eef85e95e5b3fdd66fc60e5e07e4c0ce7cdbeb9eca7778bae5b4a0302ce822a08ce30c346d62bdbd746e2c8c6c8fe015191
-
SSDEEP
49152:xMi7EDQljtuC9Ss8k9yi83GMB5rr3KJPjFJa9Ndcs8Mcs8Mcs8Mcs8M7Lbr7Lbr6:xBYDQ1th9SVk99scB
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/4472-45-0x0000000000C60000-0x0000000000C69000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x0008000000023ca0-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation iakPKCCS.exe -
Executes dropped EXE 1 IoCs
pid Process 4472 iakPKCCS.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe iakPKCCS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe iakPKCCS.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE iakPKCCS.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe iakPKCCS.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe iakPKCCS.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe iakPKCCS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe iakPKCCS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe iakPKCCS.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe iakPKCCS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe iakPKCCS.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe iakPKCCS.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe iakPKCCS.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE iakPKCCS.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe iakPKCCS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe iakPKCCS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe iakPKCCS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe iakPKCCS.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE iakPKCCS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE iakPKCCS.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe iakPKCCS.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe iakPKCCS.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe iakPKCCS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE iakPKCCS.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE iakPKCCS.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe iakPKCCS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE iakPKCCS.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe iakPKCCS.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE iakPKCCS.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe iakPKCCS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe iakPKCCS.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe iakPKCCS.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3284 sc.exe 2052 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gaming Chair.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iakPKCCS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe 1552 Gaming Chair.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1552 wrote to memory of 4472 1552 Gaming Chair.exe 84 PID 1552 wrote to memory of 4472 1552 Gaming Chair.exe 84 PID 1552 wrote to memory of 4472 1552 Gaming Chair.exe 84 PID 1552 wrote to memory of 1188 1552 Gaming Chair.exe 87 PID 1552 wrote to memory of 1188 1552 Gaming Chair.exe 87 PID 1552 wrote to memory of 1188 1552 Gaming Chair.exe 87 PID 1188 wrote to memory of 3284 1188 cmd.exe 88 PID 1188 wrote to memory of 3284 1188 cmd.exe 88 PID 1188 wrote to memory of 3284 1188 cmd.exe 88 PID 1552 wrote to memory of 1032 1552 Gaming Chair.exe 89 PID 1552 wrote to memory of 1032 1552 Gaming Chair.exe 89 PID 1552 wrote to memory of 1032 1552 Gaming Chair.exe 89 PID 1032 wrote to memory of 2052 1032 cmd.exe 90 PID 1032 wrote to memory of 2052 1032 cmd.exe 90 PID 1032 wrote to memory of 2052 1032 cmd.exe 90 PID 4472 wrote to memory of 2388 4472 iakPKCCS.exe 96 PID 4472 wrote to memory of 2388 4472 iakPKCCS.exe 96 PID 4472 wrote to memory of 2388 4472 iakPKCCS.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\Gaming Chair.exe"C:\Users\Admin\AppData\Local\Temp\Gaming Chair.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\iakPKCCS.exeC:\Users\Admin\AppData\Local\Temp\iakPKCCS.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0d66782d.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2388
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc start FairplayKD > NUL 2>&12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\sc.exesc start FairplayKD3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3284
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop %c > NUL 2>&12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Windows\SysWOW64\sc.exesc stop %c3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2052
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
191B
MD53a19ac467db52b05a49ce35b99384bc4
SHA1e3c269bc251c8bf5f58a9dbbb6bf938c511074c4
SHA256588b538d8c0e245cea3689dceba5ee6ed87edb155d9f2a949fea06586715a112
SHA51281762b020d281d6a1a880b33c1a215a1fcaebd0e7f13cfa6da433d44ec1093386e5b5730f18ce055b3b378927ef06b50d42c356ae81bbc2083fba00db88ec7cb
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e