Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2024 01:48
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-05_498b0defdf60f700d6cfb53734bc93c6_mafia_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2024-12-05_498b0defdf60f700d6cfb53734bc93c6_mafia_wapomi.exe
-
Size
603KB
-
MD5
498b0defdf60f700d6cfb53734bc93c6
-
SHA1
3debd25ea5619cc6c777786a39214995966c1278
-
SHA256
7461a45ce023dd500c7b22c730748ddd753eca44b3ab33aa695b43db2ea7fe1b
-
SHA512
b28d1659bb6d7e3247b19757166006ca3d75849f47dd53ed79f8906ca5c30ee37b57d5fbb367187f888ae9d3a07723e8f1ead3965abbf1d2056b2c2efcb5218b
-
SSDEEP
12288:cIPSKaZ3z4SB9dnLuNG3AUaAqYVzNkjvg5mxfRHg5W3PYxy0KapTrQyRTiyM:cIPSAGYG9z4vgcpRA5WwxyH2TrQyRTiy
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/1380-9-0x0000000000050000-0x0000000000059000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x0033000000023b78-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation LYfq.exe -
Executes dropped EXE 1 IoCs
pid Process 1380 LYfq.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe LYfq.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe LYfq.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe LYfq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe LYfq.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe LYfq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe LYfq.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe LYfq.exe File opened for modification C:\Program Files\7-Zip\7zG.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe LYfq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe LYfq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE LYfq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe LYfq.exe File opened for modification C:\Program Files\ReceiveEdit.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe LYfq.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe LYfq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE LYfq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe LYfq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE LYfq.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe LYfq.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe LYfq.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe LYfq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe LYfq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe LYfq.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe LYfq.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe LYfq.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe LYfq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe LYfq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe LYfq.exe File opened for modification C:\Program Files\7-Zip\7z.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe LYfq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe LYfq.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe LYfq.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe LYfq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe LYfq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LYfq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-05_498b0defdf60f700d6cfb53734bc93c6_mafia_wapomi.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 756 2024-12-05_498b0defdf60f700d6cfb53734bc93c6_mafia_wapomi.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 756 wrote to memory of 1380 756 2024-12-05_498b0defdf60f700d6cfb53734bc93c6_mafia_wapomi.exe 83 PID 756 wrote to memory of 1380 756 2024-12-05_498b0defdf60f700d6cfb53734bc93c6_mafia_wapomi.exe 83 PID 756 wrote to memory of 1380 756 2024-12-05_498b0defdf60f700d6cfb53734bc93c6_mafia_wapomi.exe 83 PID 1380 wrote to memory of 4376 1380 LYfq.exe 100 PID 1380 wrote to memory of 4376 1380 LYfq.exe 100 PID 1380 wrote to memory of 4376 1380 LYfq.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-05_498b0defdf60f700d6cfb53734bc93c6_mafia_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-05_498b0defdf60f700d6cfb53734bc93c6_mafia_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\LYfq.exeC:\Users\Admin\AppData\Local\Temp\LYfq.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\594f1169.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:4376
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD5772f925296ad09b7b4dc878d01bade69
SHA1924db28799457902814d7a6ebdffb20b92e9af68
SHA2561350afbe6483417af4fd446bcbba0dad43678602bcb3ea0bd92cd2b2d6a73943
SHA51204235fd9b661088ea75c7148c7fe2505fc1c62cdfdd546ea63b9f2c0835634be01d485f34d570d5bb95e765fa5599651a99ec8f1b1b3aa6fca7d976bb407e132
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e