Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-12-2024 18:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b7faed3a76a3df0e5e3a3907bb664b877a4cb34bae203aa50fc79450fd8708f.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
150 seconds
General
-
Target
9b7faed3a76a3df0e5e3a3907bb664b877a4cb34bae203aa50fc79450fd8708f.exe
-
Size
671KB
-
MD5
c0832808c793bb3907ea7b483835fc87
-
SHA1
ef0a266a98b4b68a36ad922dd3bc21d8dc752d3d
-
SHA256
9b7faed3a76a3df0e5e3a3907bb664b877a4cb34bae203aa50fc79450fd8708f
-
SHA512
23e9c6dc1eda806316ae3d0a0ab3e624395b965b140fd5e93983735f4aecec50f68091977e09e68d3ceef72bfa7ad3d69ce5d4cfec19808a6d152a1eb7c1212c
-
SSDEEP
12288:XJfUodPt85Phq3+rxZP7xY710le0lyyGshuhVT6S7bSqQWRfNIoS:XJfUodPt8NC8P1Y71z+ashuhB6PW
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Blackmoon family
-
Detect Blackmoon payload 1 IoCs
resource yara_rule behavioral2/memory/2108-7-0x0000000000400000-0x00000000006E9000-memory.dmp family_blackmoon -
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/2188-9-0x0000000000150000-0x0000000000159000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000c000000023b0f-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation Euo.exe -
Executes dropped EXE 1 IoCs
pid Process 2188 Euo.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe Euo.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE Euo.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe Euo.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe Euo.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe Euo.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE Euo.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe Euo.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe Euo.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe Euo.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe Euo.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE Euo.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE Euo.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe Euo.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe Euo.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE Euo.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe Euo.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe Euo.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe Euo.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe Euo.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE Euo.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe Euo.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe Euo.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe Euo.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe Euo.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe Euo.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe Euo.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe Euo.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe Euo.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe Euo.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe Euo.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE Euo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE Euo.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe Euo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9b7faed3a76a3df0e5e3a3907bb664b877a4cb34bae203aa50fc79450fd8708f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Euo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2108 9b7faed3a76a3df0e5e3a3907bb664b877a4cb34bae203aa50fc79450fd8708f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2188 2108 9b7faed3a76a3df0e5e3a3907bb664b877a4cb34bae203aa50fc79450fd8708f.exe 82 PID 2108 wrote to memory of 2188 2108 9b7faed3a76a3df0e5e3a3907bb664b877a4cb34bae203aa50fc79450fd8708f.exe 82 PID 2108 wrote to memory of 2188 2108 9b7faed3a76a3df0e5e3a3907bb664b877a4cb34bae203aa50fc79450fd8708f.exe 82 PID 2188 wrote to memory of 4688 2188 Euo.exe 92 PID 2188 wrote to memory of 4688 2188 Euo.exe 92 PID 2188 wrote to memory of 4688 2188 Euo.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b7faed3a76a3df0e5e3a3907bb664b877a4cb34bae203aa50fc79450fd8708f.exe"C:\Users\Admin\AppData\Local\Temp\9b7faed3a76a3df0e5e3a3907bb664b877a4cb34bae203aa50fc79450fd8708f.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\Euo.exeC:\Users\Admin\AppData\Local\Temp\Euo.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\08425de7.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:4688
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD530eb1ca9ec9ac8fff8c557e8db0bffd5
SHA11224f051e67218d0b1e9c3f5bcd6a4550d5568b9
SHA256a640a809ed8d6c65a49449392f7756b8093d710d3b597937d4c045a6f2bd90b4
SHA5128fc9ce62799d403b5a54f497450c25611f955b34d23f38dc0d3a3fbc5b765fb0a06d7cb38ab047756a0eb2d3b26f5384d5b685f6b91b271d0d968d701d9a189d
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e