Analysis
-
max time kernel
110s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-01-2025 05:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
120 seconds
General
-
Target
225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe
-
Size
930KB
-
MD5
4ff422aaf92192acde1d014cc7fc8490
-
SHA1
c7a1d01c21bdb07143a59e591d481ffe26705ced
-
SHA256
225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074b
-
SHA512
7c8dde9e265bb6ce2fd7f7211a988e3e744101ba50016d02814724aea125085639c7b2e49a3fdedd68a02293be4969bbd853d587b984cde3597104617bb95ed9
-
SSDEEP
12288:hr+/U0UAQ0QkiWNlyxRCugvijhCWTJUuD6q9RIHwjMj+F8ii6JqgkYUV+I7cKRg8:hqBUAPiWNA0vijQWquD2wjqIO6lnicK
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2004-12-0x00000000009F0000-0x00000000009F9000-memory.dmp family_bdaejec_backdoor behavioral1/memory/2004-33-0x00000000009F0000-0x00000000009F9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x000d000000012261-10.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2004 byvEek.exe -
Loads dropped DLL 2 IoCs
pid Process 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe File opened (read-only) \??\F: 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe byvEek.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe byvEek.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe byvEek.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe byvEek.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe byvEek.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe byvEek.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe byvEek.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe byvEek.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe byvEek.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE byvEek.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe byvEek.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe byvEek.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe byvEek.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe byvEek.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE byvEek.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe byvEek.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe byvEek.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE byvEek.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE byvEek.exe File opened for modification C:\Program Files\7-Zip\7zG.exe byvEek.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe byvEek.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe byvEek.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE byvEek.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe byvEek.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe byvEek.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe byvEek.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe byvEek.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe byvEek.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe byvEek.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe byvEek.exe File opened for modification C:\Program Files\Windows Mail\wab.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe byvEek.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe byvEek.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe byvEek.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE byvEek.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE byvEek.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe byvEek.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe byvEek.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe byvEek.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe byvEek.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe byvEek.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe byvEek.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe byvEek.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe byvEek.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe byvEek.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language byvEek.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2004 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 30 PID 2168 wrote to memory of 2004 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 30 PID 2168 wrote to memory of 2004 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 30 PID 2168 wrote to memory of 2004 2168 225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe 30 PID 2004 wrote to memory of 2720 2004 byvEek.exe 32 PID 2004 wrote to memory of 2720 2004 byvEek.exe 32 PID 2004 wrote to memory of 2720 2004 byvEek.exe 32 PID 2004 wrote to memory of 2720 2004 byvEek.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe"C:\Users\Admin\AppData\Local\Temp\225ae7e559927f217d70a4773ee6d6a36638d407e6f15304e8cfb91a21e0074bN.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\byvEek.exeC:\Users\Admin\AppData\Local\Temp\byvEek.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\5fed1f5b.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2720
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5090511abafff9bd4392d2cd0eed74788
SHA18635ccff561b84de0970c6ada2591bf76c3a40b6
SHA256c200518ac433b4992419fc97d268c9b11a9cecd1bd6b7c5746fc42b984c4fde4
SHA5124279093b69113650d261d7c8f2598ce2a6af4824bf686be42dcca9bdbcac7e517c31d1d38f11404751e7bb2bd2e9acf320e05ef60e6a554234ab517f2a2ed362
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e