Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 10:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf698c75cf8e70b00ef0dc1dca1220144aff0c016dc44fd0410e5774da3b2041.exe
Resource
win7-20240729-en
windows7-x64
10 signatures
150 seconds
General
-
Target
bf698c75cf8e70b00ef0dc1dca1220144aff0c016dc44fd0410e5774da3b2041.exe
-
Size
933KB
-
MD5
d71ffaa29328353b394dcd613d6935ab
-
SHA1
464b4fca112e9fb6a299fd44a4b32bc8a1ee4e9f
-
SHA256
bf698c75cf8e70b00ef0dc1dca1220144aff0c016dc44fd0410e5774da3b2041
-
SHA512
f457761b6e331a06ead72bf20bc5377d972b42761b2326a6090ad01eaa11bdc71ed9ac4331ef84a7a11ff8cf78bb1f7ffbc7dc7db6f5cbc4ec28faeedd324475
-
SSDEEP
12288:EJLKppfDhILiihuu2uZZSnBd4OfnJ9YeckuZIcIHwVejWqV:EcppfDhIxSnBKOfHYZ+HwVejP
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2644-13-0x0000000000090000-0x0000000000099000-memory.dmp family_bdaejec_backdoor behavioral1/memory/2644-26-0x0000000000090000-0x0000000000099000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x00080000000120fd-10.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2644 ASvJIZ.exe -
Loads dropped DLL 2 IoCs
pid Process 3032 bf698c75cf8e70b00ef0dc1dca1220144aff0c016dc44fd0410e5774da3b2041.exe 3032 bf698c75cf8e70b00ef0dc1dca1220144aff0c016dc44fd0410e5774da3b2041.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE ASvJIZ.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE ASvJIZ.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe ASvJIZ.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe ASvJIZ.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe ASvJIZ.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe ASvJIZ.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe ASvJIZ.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe ASvJIZ.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE ASvJIZ.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe ASvJIZ.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe ASvJIZ.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ASvJIZ.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe ASvJIZ.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe ASvJIZ.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe ASvJIZ.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe ASvJIZ.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe ASvJIZ.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE ASvJIZ.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE ASvJIZ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bf698c75cf8e70b00ef0dc1dca1220144aff0c016dc44fd0410e5774da3b2041.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ASvJIZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2644 3032 bf698c75cf8e70b00ef0dc1dca1220144aff0c016dc44fd0410e5774da3b2041.exe 31 PID 3032 wrote to memory of 2644 3032 bf698c75cf8e70b00ef0dc1dca1220144aff0c016dc44fd0410e5774da3b2041.exe 31 PID 3032 wrote to memory of 2644 3032 bf698c75cf8e70b00ef0dc1dca1220144aff0c016dc44fd0410e5774da3b2041.exe 31 PID 3032 wrote to memory of 2644 3032 bf698c75cf8e70b00ef0dc1dca1220144aff0c016dc44fd0410e5774da3b2041.exe 31 PID 2644 wrote to memory of 2584 2644 ASvJIZ.exe 32 PID 2644 wrote to memory of 2584 2644 ASvJIZ.exe 32 PID 2644 wrote to memory of 2584 2644 ASvJIZ.exe 32 PID 2644 wrote to memory of 2584 2644 ASvJIZ.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf698c75cf8e70b00ef0dc1dca1220144aff0c016dc44fd0410e5774da3b2041.exe"C:\Users\Admin\AppData\Local\Temp\bf698c75cf8e70b00ef0dc1dca1220144aff0c016dc44fd0410e5774da3b2041.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\ASvJIZ.exeC:\Users\Admin\AppData\Local\Temp\ASvJIZ.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3f5439d6.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2584
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5ed311f25ac213de901943532c62e45af
SHA1ea0af72e35a36a37f4d347ec3e135e08489ca333
SHA2569550ad6964db99dc572a9c734ff3bdbb61acd2ca6626bb76b06ee25e64e25dbd
SHA51237f8f6434293b8ccd41979f46fe56a7f5b8bd3ae3f1d173332924a836d4e6582ad4152c854c134a182db63ba90a9ebd8176f12099b55fadfeef274b09d059f51
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e