Analysis
-
max time kernel
106s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2024 08:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-12-28_c230cac172b81f793a56487c3bed19f2_smoke-loader_wapomi.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
General
-
Target
2024-12-28_c230cac172b81f793a56487c3bed19f2_smoke-loader_wapomi.exe
-
Size
80KB
-
MD5
c230cac172b81f793a56487c3bed19f2
-
SHA1
e21f69d2a3520b932ef290fcd6690b0662c52e3e
-
SHA256
948c903e44ee55776cb822b5194de668c0024ac11542228b2d2a207797495e4a
-
SHA512
5864b422abfe0fdfefa8f5379fe33ac813f564f35730d9a2ccdee2e08b692acb47cbe288f43d79989b6ebcca1340fffee0e81afc1801732c4bf9d73ecfecee1a
-
SSDEEP
1536:Yg/6/tM8NXDjPX0QWlfGMckTQzFGCq2iW7z:Hk3U8kTQBGCH
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/3264-8-0x0000000000C50000-0x0000000000C59000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000a000000023c12-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation ppowPB.exe -
Executes dropped EXE 1 IoCs
pid Process 3264 ppowPB.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE ppowPB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe ppowPB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE ppowPB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe ppowPB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe ppowPB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe ppowPB.exe File opened for modification C:\Program Files\7-Zip\7z.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe ppowPB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE ppowPB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe ppowPB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe ppowPB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE ppowPB.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE ppowPB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE ppowPB.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe ppowPB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe ppowPB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe ppowPB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe ppowPB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe ppowPB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe ppowPB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe ppowPB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE ppowPB.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe ppowPB.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe ppowPB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe ppowPB.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe ppowPB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe ppowPB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe ppowPB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe ppowPB.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe ppowPB.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe ppowPB.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe ppowPB.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe ppowPB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe ppowPB.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe ppowPB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-28_c230cac172b81f793a56487c3bed19f2_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppowPB.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 972 wrote to memory of 3264 972 2024-12-28_c230cac172b81f793a56487c3bed19f2_smoke-loader_wapomi.exe 82 PID 972 wrote to memory of 3264 972 2024-12-28_c230cac172b81f793a56487c3bed19f2_smoke-loader_wapomi.exe 82 PID 972 wrote to memory of 3264 972 2024-12-28_c230cac172b81f793a56487c3bed19f2_smoke-loader_wapomi.exe 82 PID 3264 wrote to memory of 2184 3264 ppowPB.exe 92 PID 3264 wrote to memory of 2184 3264 ppowPB.exe 92 PID 3264 wrote to memory of 2184 3264 ppowPB.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-28_c230cac172b81f793a56487c3bed19f2_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-28_c230cac172b81f793a56487c3bed19f2_smoke-loader_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\ppowPB.exeC:\Users\Admin\AppData\Local\Temp\ppowPB.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3fce2b43.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2184
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD54e5a443f925cb520ed33fec47b8c7577
SHA11cf782c091f7a424e9d0383f68ee8a5d5397a014
SHA2569c47e5324ac18ac2ee605700be7fd8427e44be1a310589bcde4c18e4f585d0b6
SHA51242f1e60c06e7c3c42c9693926d776923504ef50916ca4063ca110765d125ac407829421507f160f1070a5a495316955148c00d1d26386d3380e34d7c7b7b6222
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e