Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 23:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe
Resource
win7-20240708-en
General
-
Target
2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe
-
Size
983KB
-
MD5
f34ae336de2b56131a11451bc3fd6e5d
-
SHA1
3bc08e60e7730c6657f405bd9a9bbfaa2a2d1ea1
-
SHA256
8ca484b2e1fb194cc4afd7e928a79da4911f41840de90ce1a5b3721ccbfc174d
-
SHA512
1274e65c3965239ee74391c84854fd11c303d4c94b70ea23fa0abfdb7de88812d5717536a3a50987d8636a887169996ce2df29af22b5d906d3b828af193e3dd7
-
SSDEEP
24576:+Iv5QimqIakPrYsMdX3gU22+c5c6apVuXg5jk:pOXUXwF2Nrg
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2216-11-0x0000000000F70000-0x0000000000F79000-memory.dmp family_bdaejec_backdoor behavioral1/memory/2216-18-0x0000000000F70000-0x0000000000F79000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x000900000001225f-10.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2216 iYgckL.exe -
Loads dropped DLL 2 IoCs
pid Process 2184 2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe 2184 2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe iYgckL.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe iYgckL.exe File opened for modification C:\Program Files\Windows Mail\wab.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{EBB1980D-D3FB-4EE3-8028-3788F037127D}\chrome_installer.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE iYgckL.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE iYgckL.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE iYgckL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe iYgckL.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE iYgckL.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE iYgckL.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe iYgckL.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe iYgckL.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe iYgckL.exe File opened for modification C:\Program Files\7-Zip\7zG.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe iYgckL.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe iYgckL.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE iYgckL.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe iYgckL.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe iYgckL.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE iYgckL.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe iYgckL.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iYgckL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2184 2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2216 2184 2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe 30 PID 2184 wrote to memory of 2216 2184 2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe 30 PID 2184 wrote to memory of 2216 2184 2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe 30 PID 2184 wrote to memory of 2216 2184 2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe 30 PID 2216 wrote to memory of 1148 2216 iYgckL.exe 34 PID 2216 wrote to memory of 1148 2216 iYgckL.exe 34 PID 2216 wrote to memory of 1148 2216 iYgckL.exe 34 PID 2216 wrote to memory of 1148 2216 iYgckL.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\iYgckL.exeC:\Users\Admin\AppData\Local\Temp\iYgckL.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\26d63972.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1148
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5abd08fc5338321bfb882a3aa6b88e2f0
SHA1a007f73f6d535f5f5b30d7dfcaf9f6474d8f1e94
SHA256b8db7abdfae51667cd2577770353b764c51f004b2d31e65b9bbb110f531215c3
SHA512fd8276c9b0a8c98a1ccd2fca045995c833b92121690aa8f88583c56042df2c7d557227488e7f2c403c4fc25636a45b1cdd7d8c2407a0f24a7fa5274268d76ad0
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e