bdaejec | 2912ebfc163c970d25a666d2723682bfbf8e2a202867b12dc0fec6afa531497e

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
15/12/2024, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OASIS AIO TOOL/adb.exe
Size

816KB
MD5

b16c4b8a4215ad7c9c012c7e9375af3e
SHA1

b4d67ed6ecf5af7b487c59770cb7ec9f12e6760c
SHA256

14ab5941dbc67eda143b082c80318e3606ba54d964267c1175ce728cce885a31
SHA512

43a6b0477342460fa3cf0517a925eb7e160b0c2f63a6be19d4d4cf0f7f693aed0838e8ab4906f9fea33a9083d4dce6dd59f9c578b9774838ae93b50d96ded95f
SSDEEP

12288:+5KIVNAIOlVvllPhcjpGsv6cViTIlZThJCmG11RuMYRO2fJpUGpdmTfFnIY:+5KYALlvlPyjpGo6cMTI7bqYaTfFnIY

Score

10^/10

bdaejec aspackv2 backdoor discovery

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec
Bdaejec family
bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral9/memory/280-24-0x0000000000280000-0x0000000000289000-memory.dmp	family_bdaejec_backdoor

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral9/files/0x000c00000001202c-2.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
280	dhAcrH.exe

Loads dropped DLL 2 IoCs

pid	Process
2556	adb.exe
2556	adb.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaws.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe	dhAcrH.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE	dhAcrH.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javacpl.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jre7\bin\orbd.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE	dhAcrH.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Windows Mail\WinMail.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	dhAcrH.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	dhAcrH.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	dhAcrH.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE	dhAcrH.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dhAcrH.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 280	2556	adb.exe	31
PID 2556 wrote to memory of 280	2556	adb.exe	31
PID 2556 wrote to memory of 280	2556	adb.exe	31
PID 2556 wrote to memory of 280	2556	adb.exe	31
PID 280 wrote to memory of 1144	280	dhAcrH.exe	34
PID 280 wrote to memory of 1144	280	dhAcrH.exe	34
PID 280 wrote to memory of 1144	280	dhAcrH.exe	34
PID 280 wrote to memory of 1144	280	dhAcrH.exe	34

C:\Users\Admin\AppData\Local\Temp\OASIS AIO TOOL\adb.exe
"C:\Users\Admin\AppData\Local\Temp\OASIS AIO TOOL\adb.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Users\Admin\AppData\Local\Temp\dhAcrH.exe
  C:\Users\Admin\AppData\Local\Temp\dhAcrH.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:280
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\36164305.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\36164305.bat

Filesize
187B

MD5
699ca1def8d47da78ed207329d4f8932

SHA1
c579ceddf83d6d434802a8b893ca0d7d9fc90549

SHA256
773b5ff03f09ee865e27a5cc170c052c0afd658b8c0d3d4af16373a22cbebe55

SHA512
ace28e8ae5a316a8427b882b79eb05ab8356bf9312253bb3cd144976edf6a0acea2fca3156bf95a84526a029bebe781d4458645e658bcff74f35bbab8a1c98e0

Download Submit
\Users\Admin\AppData\Local\Temp\dhAcrH.exe

Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
memory/280-11-0x0000000000280000-0x0000000000289000-memory.dmp

Filesize
36KB

Download
memory/280-24-0x0000000000280000-0x0000000000289000-memory.dmp

Filesize
36KB

Download
memory/2556-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download
memory/2556-4-0x0000000000360000-0x0000000000369000-memory.dmp

Filesize
36KB

Download
memory/2556-14-0x0000000000400000-0x00000000004E6000-memory.dmp

Filesize
920KB

Download