Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 16:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-30_86ea23e24d6cb77ffdb42da9c9574dd2_smoke-loader_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2024-12-30_86ea23e24d6cb77ffdb42da9c9574dd2_smoke-loader_wapomi.exe
-
Size
36KB
-
MD5
86ea23e24d6cb77ffdb42da9c9574dd2
-
SHA1
0b6f18a54e809115049e57f7aa34973cab1d3977
-
SHA256
0a640b8fee4af39e76f48dedd2e77cdfaf334b8a31ef4b64beea2e2adff484c3
-
SHA512
6fb6c0b65f6f4935bcbc4facaa60c5a556899292e4c3f7b5840a38111665a6facf34e727527c6dae8dc03669fa926e3a041925dbbca9d72347d356b01c91751c
-
SSDEEP
768:aA+m41HKUpOv068E4Mf4MMRt4MtV2n5sjQGPL4vzZq2o9W7GsxBbPr:aA+m6qqOcVEP87T2n5s0GCq2iW7z
Malware Config
Extracted
bdaejec
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/1596-18-0x0000000000970000-0x0000000000979000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000c000000023b0b-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RDHAeV.exe -
Executes dropped EXE 1 IoCs
pid Process 1596 RDHAeV.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe RDHAeV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe RDHAeV.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe RDHAeV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe RDHAeV.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe RDHAeV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe RDHAeV.exe File opened for modification C:\Program Files\7-Zip\7z.exe RDHAeV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe RDHAeV.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe RDHAeV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe RDHAeV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe RDHAeV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe RDHAeV.exe File opened for modification C:\Program Files\Windows Mail\wab.exe RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe RDHAeV.exe File opened for modification C:\Program Files\7-Zip\7zG.exe RDHAeV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe RDHAeV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE RDHAeV.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe RDHAeV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe RDHAeV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe RDHAeV.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe RDHAeV.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe RDHAeV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe RDHAeV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe RDHAeV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe RDHAeV.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe RDHAeV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe RDHAeV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe RDHAeV.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe RDHAeV.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe RDHAeV.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RDHAeV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-30_86ea23e24d6cb77ffdb42da9c9574dd2_smoke-loader_wapomi.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3396 2024-12-30_86ea23e24d6cb77ffdb42da9c9574dd2_smoke-loader_wapomi.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3396 wrote to memory of 1596 3396 2024-12-30_86ea23e24d6cb77ffdb42da9c9574dd2_smoke-loader_wapomi.exe 83 PID 3396 wrote to memory of 1596 3396 2024-12-30_86ea23e24d6cb77ffdb42da9c9574dd2_smoke-loader_wapomi.exe 83 PID 3396 wrote to memory of 1596 3396 2024-12-30_86ea23e24d6cb77ffdb42da9c9574dd2_smoke-loader_wapomi.exe 83 PID 1596 wrote to memory of 1440 1596 RDHAeV.exe 85 PID 1596 wrote to memory of 1440 1596 RDHAeV.exe 85 PID 1596 wrote to memory of 1440 1596 RDHAeV.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-30_86ea23e24d6cb77ffdb42da9c9574dd2_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-30_86ea23e24d6cb77ffdb42da9c9574dd2_smoke-loader_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\RDHAeV.exeC:\Users\Admin\AppData\Local\Temp\RDHAeV.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\26d228b7.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1440
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD595614e7161140be66e750d9610e0c858
SHA1437b5baa347588bf3180efbf37fba292a43a1c45
SHA2564ae588d229cb8367ac9633f8e248c38850d2a06b3503838fde29b862697422be
SHA5128cb8449c765fc419e3154dfb59796c14bb832abe563b91d6af5775c78c5fa3c9d7ea674d2af2d7285d3b15fa71c3c357d96e0b8233da9bebfdbc35bf5024535a
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e