Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/12/2024, 20:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
General
-
Target
2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe
-
Size
310KB
-
MD5
8e43847f0b4c09d45f7c44b5928d9fd2
-
SHA1
a320c92e79fca1b36d8cf0924b7ff18399f71cf6
-
SHA256
b0b3f98718eba4c1e847d81f767c018ac291d233b247ae8aecae8883eb82be32
-
SHA512
43d03337fd41b881958009f9bba8cef1d171e1aaa5cf41a8d30ee6bb3e3b8ad98a5164ba22d23fd09edeeeaa6a5307f6805bdca51a313f91cd16e657911b3f25
-
SSDEEP
6144:oznAtGqS5NjM2KbQbNYuhZ+6+eAbuQ5Zu60HnPLhDgWo:oTLnp+BCQ5Zu60HnP1
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/1984-12-0x0000000000D50000-0x0000000000D59000-memory.dmp family_bdaejec_backdoor behavioral1/memory/1984-22-0x0000000000D50000-0x0000000000D59000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x0007000000012117-1.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1984 yShEiB.exe -
Loads dropped DLL 2 IoCs
pid Process 2092 2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe 2092 2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe yShEiB.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe yShEiB.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{9DFE08CC-30AD-4427-BBD2-AE53EED44C59}\chrome_installer.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE yShEiB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE yShEiB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE yShEiB.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe yShEiB.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe yShEiB.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE yShEiB.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe yShEiB.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe yShEiB.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe yShEiB.exe File opened for modification C:\Program Files\7-Zip\7zG.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe yShEiB.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe yShEiB.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe yShEiB.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe yShEiB.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe yShEiB.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe yShEiB.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe yShEiB.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe yShEiB.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe yShEiB.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe yShEiB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yShEiB.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2092 wrote to memory of 1984 2092 2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe 31 PID 2092 wrote to memory of 1984 2092 2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe 31 PID 2092 wrote to memory of 1984 2092 2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe 31 PID 2092 wrote to memory of 1984 2092 2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe 31 PID 1984 wrote to memory of 1364 1984 yShEiB.exe 34 PID 1984 wrote to memory of 1364 1984 yShEiB.exe 34 PID 1984 wrote to memory of 1364 1984 yShEiB.exe 34 PID 1984 wrote to memory of 1364 1984 yShEiB.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\yShEiB.exeC:\Users\Admin\AppData\Local\Temp\yShEiB.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\18a47f56.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1364
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD54aea67d1cdf7a95d0282542f6cda8aee
SHA1f964081810579dd0a9f585aa628b36bb7a323e85
SHA25680bf27e7326fb0f38636c6c542c8a8d2b22f43ffc2cc754ce7fae3b17650c5ef
SHA512ae6a012431bd71e9203d1fff644daf780f76e12e79de960730070995d554519afa0b2c752861723f584ced95009ef80039f82b3d4abddffd56aaa4ebd5369883
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e