Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2024, 19:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-12-04_f4d738ff4cdb964520eb62527e2e3242_icedid_smoke-loader_wapomi.exe
Resource
win7-20241023-en
windows7-x64
10 signatures
150 seconds
General
-
Target
2024-12-04_f4d738ff4cdb964520eb62527e2e3242_icedid_smoke-loader_wapomi.exe
-
Size
310KB
-
MD5
f4d738ff4cdb964520eb62527e2e3242
-
SHA1
4df5177eabe1519462d3a3d5630470f74fea424a
-
SHA256
0c5e6c14c91eabd856cdf77da435effd286d912ecffa3d999082878408268f60
-
SHA512
d74e04c1ffa2ad3b4ab90c3269b1f9d1d18686ce3f991ec68bdbdeaabab9251205643d1f96c6115127245d561252cfd687f281e1e25d05d1bca09202b9a5fd4e
-
SSDEEP
6144:oznAtGqS5NjM2KbQbNYuhZ+6+eAbuQ5Zu60HnPLhDgWg:oTLnp+BCQ5Zu60HnP1
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/3136-8-0x0000000000C40000-0x0000000000C49000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000a000000023c08-4.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation gHePMW.exe -
Executes dropped EXE 1 IoCs
pid Process 3136 gHePMW.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe gHePMW.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe gHePMW.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe gHePMW.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe gHePMW.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe gHePMW.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe gHePMW.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe gHePMW.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe gHePMW.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe gHePMW.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE gHePMW.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe gHePMW.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe gHePMW.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe gHePMW.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe gHePMW.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE gHePMW.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe gHePMW.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe gHePMW.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe gHePMW.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe gHePMW.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe gHePMW.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe gHePMW.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe gHePMW.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe gHePMW.exe File opened for modification C:\Program Files\7-Zip\7z.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE gHePMW.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE gHePMW.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe gHePMW.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe gHePMW.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe gHePMW.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-04_f4d738ff4cdb964520eb62527e2e3242_icedid_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gHePMW.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1124 wrote to memory of 3136 1124 2024-12-04_f4d738ff4cdb964520eb62527e2e3242_icedid_smoke-loader_wapomi.exe 83 PID 1124 wrote to memory of 3136 1124 2024-12-04_f4d738ff4cdb964520eb62527e2e3242_icedid_smoke-loader_wapomi.exe 83 PID 1124 wrote to memory of 3136 1124 2024-12-04_f4d738ff4cdb964520eb62527e2e3242_icedid_smoke-loader_wapomi.exe 83 PID 3136 wrote to memory of 2572 3136 gHePMW.exe 93 PID 3136 wrote to memory of 2572 3136 gHePMW.exe 93 PID 3136 wrote to memory of 2572 3136 gHePMW.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-04_f4d738ff4cdb964520eb62527e2e3242_icedid_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-04_f4d738ff4cdb964520eb62527e2e3242_icedid_smoke-loader_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\gHePMW.exeC:\Users\Admin\AppData\Local\Temp\gHePMW.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\73f4546a.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2572
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5dc3583c70dc8b2c2cd7e60ca5ce5e5f8
SHA199b7886a9034cb2be88afde2242bc690a06f26dd
SHA256c62ff48552e5d7912939538644ec9004afad1f9d2b5b176762a806a30d1dbcd5
SHA5124b64c0cf98697bc1844a12ec0392709b49272e01306615ad6bb2afc886b6d31f5b9768a5112144b64311c295646c2aa7c21ef0e7a5c3641a7788972be3c6cabd
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e