Analysis
-
max time kernel
127s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2024 08:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-12-28_ac90e952b3508491540fd42dfec638cf_mafia_wapomi.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
General
-
Target
2024-12-28_ac90e952b3508491540fd42dfec638cf_mafia_wapomi.exe
-
Size
187KB
-
MD5
ac90e952b3508491540fd42dfec638cf
-
SHA1
aebe6fe632a0edcab4ee320d7de3b0a691373336
-
SHA256
8dab5f1113bde28029437a289054e66212202e3490664562f16833dfdbe174a7
-
SHA512
83f5769910737f8aecb41dcc0c8afbf90af36503102999badb7a0bd59a53b603cfea530aafaddd986318fa510081d54b3e510439bcf877352f77f0090664eee3
-
SSDEEP
3072:uLKCpw8DA3Yr3mUOJfXEEZnRCI3AXny/Hj8LG4MVj/FIgW6dvn3mxIO3GCH:e83YLmUOFXEEZnRCI3AXny/Hj8LG4ujb
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/3692-8-0x0000000000F00000-0x0000000000F09000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000c000000023b1e-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation Srkhxf.exe -
Executes dropped EXE 1 IoCs
pid Process 3692 Srkhxf.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe Srkhxf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe Srkhxf.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Srkhxf.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE Srkhxf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe Srkhxf.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe Srkhxf.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe Srkhxf.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe Srkhxf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe Srkhxf.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe Srkhxf.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe Srkhxf.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe Srkhxf.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe Srkhxf.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe Srkhxf.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE Srkhxf.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe Srkhxf.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe Srkhxf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-28_ac90e952b3508491540fd42dfec638cf_mafia_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Srkhxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5112 wrote to memory of 3692 5112 2024-12-28_ac90e952b3508491540fd42dfec638cf_mafia_wapomi.exe 86 PID 5112 wrote to memory of 3692 5112 2024-12-28_ac90e952b3508491540fd42dfec638cf_mafia_wapomi.exe 86 PID 5112 wrote to memory of 3692 5112 2024-12-28_ac90e952b3508491540fd42dfec638cf_mafia_wapomi.exe 86 PID 3692 wrote to memory of 4992 3692 Srkhxf.exe 104 PID 3692 wrote to memory of 4992 3692 Srkhxf.exe 104 PID 3692 wrote to memory of 4992 3692 Srkhxf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-28_ac90e952b3508491540fd42dfec638cf_mafia_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-28_ac90e952b3508491540fd42dfec638cf_mafia_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\Srkhxf.exeC:\Users\Admin\AppData\Local\Temp\Srkhxf.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\05501246.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:4992
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD54be2c5e8c2ecae086a08cc5f7bbe7691
SHA1e4d9fe92508d232300128c5d1d640f222ad66579
SHA256152890ed23243726d558f1b02799f822c8e170566f71aa89fb59be33dcf63c72
SHA51261a0b5cab6cafeafb82cdd065bd7b7cbd8698cf3e54c024dd05758a0d342ff82cb1271f185645a9446c286622f86dda994b7c30e2727342fb07b24e69ec14ba6
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e