Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2024 20:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe
-
Size
310KB
-
MD5
8e43847f0b4c09d45f7c44b5928d9fd2
-
SHA1
a320c92e79fca1b36d8cf0924b7ff18399f71cf6
-
SHA256
b0b3f98718eba4c1e847d81f767c018ac291d233b247ae8aecae8883eb82be32
-
SHA512
43d03337fd41b881958009f9bba8cef1d171e1aaa5cf41a8d30ee6bb3e3b8ad98a5164ba22d23fd09edeeeaa6a5307f6805bdca51a313f91cd16e657911b3f25
-
SSDEEP
6144:oznAtGqS5NjM2KbQbNYuhZ+6+eAbuQ5Zu60HnPLhDgWo:oTLnp+BCQ5Zu60HnP1
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/3152-8-0x0000000000860000-0x0000000000869000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000b000000023b89-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation yShEiB.exe -
Executes dropped EXE 1 IoCs
pid Process 3152 yShEiB.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe yShEiB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe yShEiB.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe yShEiB.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe yShEiB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe yShEiB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe yShEiB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe yShEiB.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe yShEiB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe yShEiB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe yShEiB.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe yShEiB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe yShEiB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe yShEiB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe yShEiB.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe yShEiB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe yShEiB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe yShEiB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe yShEiB.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe yShEiB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE yShEiB.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE yShEiB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe yShEiB.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe yShEiB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe yShEiB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe yShEiB.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe yShEiB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe yShEiB.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe yShEiB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yShEiB.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2404 wrote to memory of 3152 2404 2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe 83 PID 2404 wrote to memory of 3152 2404 2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe 83 PID 2404 wrote to memory of 3152 2404 2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe 83 PID 3152 wrote to memory of 976 3152 yShEiB.exe 93 PID 3152 wrote to memory of 976 3152 yShEiB.exe 93 PID 3152 wrote to memory of 976 3152 yShEiB.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-09_8e43847f0b4c09d45f7c44b5928d9fd2_icedid_smoke-loader_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\yShEiB.exeC:\Users\Admin\AppData\Local\Temp\yShEiB.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4c4c3ef0.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:976
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD58ea4b17a071b16ae0b1009240daa027d
SHA12d3e89b2f34435c80dfaa1f696224e5e100650f7
SHA256d8800d2d9aefb99466346398469b0bbb86b18fc3cb5f1f8bbea40e797c67f6e0
SHA5128ceb2b92f2e7463278b524908349dfcb505f814df4730ffb89852a897a690835ff069d4d8205bd253821dc56c7dccce4655542860d66f66c7d4cedbf1941a91f
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e