Analysis
-
max time kernel
106s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2024 01:09
Static task
static1
1 signatures
General
-
Target
6ad7e53a2be770f646ef21fd5bcee00b71479a733937856b0f6d9132b8dc4521.exe
-
Size
91KB
-
MD5
b7db3fa0c089cd47d831b6c1d4d212a9
-
SHA1
06924776a0ddcffda8ce5c1d08c46488937df678
-
SHA256
6ad7e53a2be770f646ef21fd5bcee00b71479a733937856b0f6d9132b8dc4521
-
SHA512
d5961517bcc0b5a33fdf1ec8a6047723ffc48a2bd5b139400bdd007a8fc6b2bbc11b40dc4f3f8d7f6f227f0276363f0c571c04ef9a0191bbca93a552f78db487
-
SSDEEP
1536:jiq1GxAg85me0rfAJMsa2tjdMF4O7WV2XmatGCq2iW7z+:jiqExAf5me0rfAJMsa2hyRWV2vtGCHS
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/1668-8-0x0000000000B50000-0x0000000000B59000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x0008000000023ca7-5.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation tWkrPJ.exe -
Executes dropped EXE 1 IoCs
pid Process 1668 tWkrPJ.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe tWkrPJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe tWkrPJ.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE tWkrPJ.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE tWkrPJ.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE tWkrPJ.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe tWkrPJ.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{4E6AEEAD-B62E-4CF8-80E5-2A66138AEFDE}\chrome_installer.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe tWkrPJ.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe tWkrPJ.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE tWkrPJ.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe tWkrPJ.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe tWkrPJ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ad7e53a2be770f646ef21fd5bcee00b71479a733937856b0f6d9132b8dc4521.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tWkrPJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3156 wrote to memory of 1668 3156 6ad7e53a2be770f646ef21fd5bcee00b71479a733937856b0f6d9132b8dc4521.exe 84 PID 3156 wrote to memory of 1668 3156 6ad7e53a2be770f646ef21fd5bcee00b71479a733937856b0f6d9132b8dc4521.exe 84 PID 3156 wrote to memory of 1668 3156 6ad7e53a2be770f646ef21fd5bcee00b71479a733937856b0f6d9132b8dc4521.exe 84 PID 1668 wrote to memory of 220 1668 tWkrPJ.exe 102 PID 1668 wrote to memory of 220 1668 tWkrPJ.exe 102 PID 1668 wrote to memory of 220 1668 tWkrPJ.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ad7e53a2be770f646ef21fd5bcee00b71479a733937856b0f6d9132b8dc4521.exe"C:\Users\Admin\AppData\Local\Temp\6ad7e53a2be770f646ef21fd5bcee00b71479a733937856b0f6d9132b8dc4521.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\tWkrPJ.exeC:\Users\Admin\AppData\Local\Temp\tWkrPJ.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\668545a8.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:220
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD587c9b5580bddeafb523111255af9c22e
SHA17d0cb27fc5853acab2a812ea8783ca5020bc1f3b
SHA256355c8eac9de62e14d356f2df3e02cf1111f79123592d10af081f38307d1636f4
SHA51266f376a7925d4e34fe7a0b1e919e10c31a37c0716a1745bb545a49bd2681e6f35d6acb4601ca25922e7785aa15c37a5b1bc68c2172e434be3ae9c5f738ae6772
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e