Analysis
-
max time kernel
106s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-01-2025 03:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040N.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
120 seconds
General
-
Target
8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040N.exe
-
Size
303KB
-
MD5
0aa8d993c08ea9016c128a2305d3da90
-
SHA1
dd8918ecf580fe41bf7eb3bb5c0a501e1fcd9b8a
-
SHA256
8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040
-
SHA512
d195b31db8c64d95b356005df1d40ea0310475b6cc088ebcfc19d49aa95b841345d0837cf1bf0aeded68abe5062fb7d0569d67b068f9ce247f28b160469dbf4c
-
SSDEEP
6144:RdZiP3k3YeDgU5nMNsDQzcmGxF1RYTc3fD8Xhwm3zdiMMKpLI:RdZc0lp4PzanGQ3fAC2Mo
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/5044-15-0x0000000000B80000-0x0000000000B89000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x0008000000023cba-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation EPawkj.exe -
Executes dropped EXE 1 IoCs
pid Process 5044 EPawkj.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe EPawkj.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe EPawkj.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe EPawkj.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe EPawkj.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE EPawkj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe EPawkj.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe EPawkj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe EPawkj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe EPawkj.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE EPawkj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe EPawkj.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe EPawkj.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE EPawkj.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe EPawkj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe EPawkj.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe EPawkj.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe EPawkj.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE EPawkj.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe EPawkj.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe EPawkj.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe EPawkj.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE EPawkj.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe EPawkj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EPawkj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4844 wrote to memory of 5044 4844 8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040N.exe 84 PID 4844 wrote to memory of 5044 4844 8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040N.exe 84 PID 4844 wrote to memory of 5044 4844 8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040N.exe 84 PID 5044 wrote to memory of 1516 5044 EPawkj.exe 100 PID 5044 wrote to memory of 1516 5044 EPawkj.exe 100 PID 5044 wrote to memory of 1516 5044 EPawkj.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040N.exe"C:\Users\Admin\AppData\Local\Temp\8c54282733f647ca484404699d6ca275f0d19465ec436999ec888f053afc4040N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\EPawkj.exeC:\Users\Admin\AppData\Local\Temp\EPawkj.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7c357738.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1516
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD500df0b5aa11b53b15d8eb1fabf428eb2
SHA14ff30040d318661472efbc79df5fb98041bfc47b
SHA256c1e74ac4670b0a9cd3e0d0343bd0b5e9f2366e32fbf1a7986d6b16668ebea7ab
SHA512ec9c8d9055403a967d9af038daf8394d8d33c5320c89bf82e137378dbd9e194b5724cd88ff12fb6504cd1f9468b4a519e2c84396a624ec331427c8be033d0e8a
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e