Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2024 23:21
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe
Resource
win7-20240708-en
General
-
Target
2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe
-
Size
983KB
-
MD5
f34ae336de2b56131a11451bc3fd6e5d
-
SHA1
3bc08e60e7730c6657f405bd9a9bbfaa2a2d1ea1
-
SHA256
8ca484b2e1fb194cc4afd7e928a79da4911f41840de90ce1a5b3721ccbfc174d
-
SHA512
1274e65c3965239ee74391c84854fd11c303d4c94b70ea23fa0abfdb7de88812d5717536a3a50987d8636a887169996ce2df29af22b5d906d3b828af193e3dd7
-
SSDEEP
24576:+Iv5QimqIakPrYsMdX3gU22+c5c6apVuXg5jk:pOXUXwF2Nrg
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/628-10-0x0000000000060000-0x0000000000069000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000c000000023b96-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation iYgckL.exe -
Executes dropped EXE 1 IoCs
pid Process 628 iYgckL.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe iYgckL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe iYgckL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe iYgckL.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe iYgckL.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe iYgckL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe iYgckL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe iYgckL.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE iYgckL.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe iYgckL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe iYgckL.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe iYgckL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe iYgckL.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE iYgckL.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe iYgckL.exe File opened for modification C:\Program Files\dotnet\dotnet.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe iYgckL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe iYgckL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE iYgckL.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE iYgckL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe iYgckL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe iYgckL.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe iYgckL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe iYgckL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE iYgckL.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iYgckL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3168 wrote to memory of 628 3168 2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe 82 PID 3168 wrote to memory of 628 3168 2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe 82 PID 3168 wrote to memory of 628 3168 2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe 82 PID 628 wrote to memory of 64 628 iYgckL.exe 92 PID 628 wrote to memory of 64 628 iYgckL.exe 92 PID 628 wrote to memory of 64 628 iYgckL.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-04_f34ae336de2b56131a11451bc3fd6e5d_smoke-loader_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\iYgckL.exeC:\Users\Admin\AppData\Local\Temp\iYgckL.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\61930db6.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:64
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5cf46158d5088bffebc65d12bd322b80b
SHA1698ee5e2425b8c1bdcabea9d6f4f07d3e072ed37
SHA2564dfda4e49e98ce1f8397b6f4d665e4f20be41fea635dbfb9bbc7a341e3de7b91
SHA512617344dfe3cca7d8647a9e74a8a0a7298aa7c3beefba6144b25af637f75ba6f0d52eeb3e525b513ca93395b707993e278b12ef24b3f33ad0554a053be38d3ed5
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e