Analysis
-
max time kernel
106s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 02:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe
Resource
win7-20241023-en
windows7-x64
14 signatures
150 seconds
General
-
Target
2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe
-
Size
97KB
-
MD5
3c9f07fe42e12769e69df75c7237d3cf
-
SHA1
8b093539e667ff7ab1e0c9ed5442e5783023fa79
-
SHA256
de52ade1c9a21ce4c505ea7bb7d9ea353af273ae3bbd481ffc3c919c7ddf1eb8
-
SHA512
997c94ee7aa9d2f8f643b0c2c7b51db715d6246d3238c0a295aef449fc61ea0ef92bb9b9204d3767b0be4f10210e1b6fe53e7da9ae136ed515e829397dc1304e
-
SSDEEP
1536:tAqjKy4CvMHFl3LZRAAwLdn2pkhPP79+W7tduPGCq2iW7z:aqjH4Cv8NEAwLNYkhPp+W7td0GCH
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/4388-8-0x0000000000D00000-0x0000000000D09000-memory.dmp family_bdaejec_backdoor -
Detected Nirsoft tools 2 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/3192-0-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft behavioral2/memory/3192-7-0x0000000000400000-0x000000000041C000-memory.dmp Nirsoft -
resource yara_rule behavioral2/files/0x000c000000023b33-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation gxk.exe -
Executes dropped EXE 1 IoCs
pid Process 4388 gxk.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe gxk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe gxk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe gxk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe gxk.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe gxk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe gxk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe gxk.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe gxk.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe gxk.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe gxk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe gxk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe gxk.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe gxk.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe gxk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE gxk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE gxk.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe gxk.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe gxk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe gxk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE gxk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe gxk.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe gxk.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE gxk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe gxk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE gxk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe gxk.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe gxk.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe gxk.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe gxk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gxk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3192 2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe 3192 2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe 3192 2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe 3192 2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3192 2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3192 wrote to memory of 4388 3192 2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe 84 PID 3192 wrote to memory of 4388 3192 2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe 84 PID 3192 wrote to memory of 4388 3192 2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe 84 PID 4388 wrote to memory of 3340 4388 gxk.exe 102 PID 4388 wrote to memory of 3340 4388 gxk.exe 102 PID 4388 wrote to memory of 3340 4388 gxk.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-26_3c9f07fe42e12769e69df75c7237d3cf_smoke-loader_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\gxk.exeC:\Users\Admin\AppData\Local\Temp\gxk.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1c9f1420.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:3340
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD514212b8c700bfcff08043c4e39f7d65c
SHA1b55cacbc8ad3074dfde4c03f1c99579bfc3091b6
SHA256c9924e3b8047befd8b3ae142f6b6e29658e1940cf6dc3c2469ef2500db4776eb
SHA512e4dd311bb590cebcacbdc7eafdb705eae90bb0ddef72c283c09c07ee78ca2b6ae9741858f65a2003e260d3944fcf770aceb41189b74cf0780b07b5ffe46278e0
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e