Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2024, 19:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe
-
Size
12.1MB
-
MD5
e9fc2381cfd60a5353b73e6c394b5caf
-
SHA1
61c84c9282eb870315e40992b45c65d9936cf84f
-
SHA256
f11968df196f1c4fa3be918636fff4a8068c26e3a1fd72a51122ca23585659c9
-
SHA512
e0b5bed3093db2351bf9df49955f8a49584601d01d0393910d192584daec9a7d423c2df0580aa68d0b1e4aa32e627024bd1fab3722a47b8f120b40acdb2a7cee
-
SSDEEP
196608:KqqKNdE37uPvvyqOnkhJsv6tWKFdu9Cie9GJ:KqqKNIC3bOSJsv6tWKFdu9Cdy
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/3152-14-0x00000000003B0000-0x00000000003B9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000f000000023a30-4.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 3152 BoVjvr.exe 1572 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.bin -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe BoVjvr.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE BoVjvr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe BoVjvr.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE BoVjvr.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE BoVjvr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe BoVjvr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe BoVjvr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe BoVjvr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE BoVjvr.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe BoVjvr.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe BoVjvr.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe BoVjvr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe BoVjvr.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe BoVjvr.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe BoVjvr.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.123\chrome_installer.exe BoVjvr.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe BoVjvr.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe BoVjvr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe BoVjvr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe BoVjvr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe BoVjvr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe BoVjvr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe BoVjvr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE BoVjvr.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe BoVjvr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe BoVjvr.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{8A1C963D-7054-4DC6-AA98-9FBFCE5E4C3B}\chrome_installer.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe BoVjvr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe BoVjvr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE BoVjvr.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe BoVjvr.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BoVjvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.bin -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 640 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe 1572 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.bin -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1572 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.bin -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 640 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe 1572 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.bin -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 640 wrote to memory of 3152 640 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe 86 PID 640 wrote to memory of 3152 640 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe 86 PID 640 wrote to memory of 3152 640 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe 86 PID 640 wrote to memory of 1572 640 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe 87 PID 640 wrote to memory of 1572 640 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe 87 PID 640 wrote to memory of 1572 640 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\BoVjvr.exeC:\Users\Admin\AppData\Local\Temp\BoVjvr.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3152
-
-
C:\Users\Admin\AppData\Local\Temp\2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.binC:\Users\Admin\AppData\Local\Temp\2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.bin C:\Users\Admin\AppData\Local\Temp\2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.bin
Filesize12.1MB
MD5e9fc2381cfd60a5353b73e6c394b5caf
SHA161c84c9282eb870315e40992b45c65d9936cf84f
SHA256f11968df196f1c4fa3be918636fff4a8068c26e3a1fd72a51122ca23585659c9
SHA512e0b5bed3093db2351bf9df49955f8a49584601d01d0393910d192584daec9a7d423c2df0580aa68d0b1e4aa32e627024bd1fab3722a47b8f120b40acdb2a7cee
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e