Analysis
-
max time kernel
108s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-01-2025 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
120 seconds
General
-
Target
6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe
-
Size
640KB
-
MD5
5ed2a3125ba2aff42060ba2f94aa0b8b
-
SHA1
46cbf7f4dfbce1a505d7c722594bbc241f2c219e
-
SHA256
6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5
-
SHA512
7f4f0024087f89d0f10d8111ae4a91d277e0fde8151eb531152e013a0c0b7355b7ca5cfb6b2d248ef1c670fec8d6c4ad3ecee74f0cd21ff45cb49d19fa216654
-
SSDEEP
12288:hJUvxKcxpJ6HL3D0jwiZcaKqqnfrjSZYqWP8Eq7tbgVv09smaMQ:U3xQDdiZcaKZYkq7tbg9X
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/1524-24-0x0000000000B70000-0x0000000000B79000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x000c000000012280-11.dat aspack_v212_v242 behavioral1/memory/1524-17-0x0000000000020000-0x0000000000029000-memory.dmp aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1524 oUe.exe -
Loads dropped DLL 5 IoCs
pid Process 2456 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe 2456 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe 1524 oUe.exe 1524 oUe.exe 1524 oUe.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe oUe.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe oUe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe oUe.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe oUe.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe oUe.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe oUe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe oUe.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe oUe.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe oUe.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe oUe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE oUe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE oUe.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe oUe.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe oUe.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe oUe.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe oUe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE oUe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe oUe.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe oUe.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe oUe.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe oUe.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe oUe.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe oUe.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{C650E966-B14F-4E38-8E3C-8BE886B090A9}\chrome_installer.exe oUe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe oUe.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe oUe.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe oUe.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe oUe.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe oUe.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe oUe.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe oUe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe oUe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE oUe.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe oUe.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe oUe.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe oUe.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe oUe.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe oUe.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe oUe.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe oUe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE oUe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE oUe.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe oUe.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe oUe.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oUe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2456 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe 2456 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2456 wrote to memory of 1524 2456 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe 31 PID 2456 wrote to memory of 1524 2456 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe 31 PID 2456 wrote to memory of 1524 2456 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe 31 PID 2456 wrote to memory of 1524 2456 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe 31 PID 2456 wrote to memory of 1524 2456 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe 31 PID 2456 wrote to memory of 1524 2456 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe 31 PID 2456 wrote to memory of 1524 2456 6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe 31 PID 1524 wrote to memory of 2064 1524 oUe.exe 35 PID 1524 wrote to memory of 2064 1524 oUe.exe 35 PID 1524 wrote to memory of 2064 1524 oUe.exe 35 PID 1524 wrote to memory of 2064 1524 oUe.exe 35 PID 1524 wrote to memory of 2064 1524 oUe.exe 35 PID 1524 wrote to memory of 2064 1524 oUe.exe 35 PID 1524 wrote to memory of 2064 1524 oUe.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe"C:\Users\Admin\AppData\Local\Temp\6cd6bcc4434c3b07b3ef598cb2bffed628ce64f7570b6f0d0c2ba5a84f3d23f5.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\oUe.exeC:\Users\Admin\AppData\Local\Temp\oUe.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\3a3a3601.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2064
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD52f40fd612cf0abe334d6da541f150b4c
SHA19b33ee5d1282c5ccf6d36a5b42a7f611f2c3bd0b
SHA256b013f67676ce50111b339769600669fd86f77c9d08b0becda38561b9be5e371e
SHA51265a38281ae6355cafe6c903d5597bfb1bc8e6006621922ed5a3347400ad73c8d42b030644cab62137be4eea985b35e72706786815e656a57fc4f9c26d2a718bf
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e