Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-01-2025 19:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2025-01-02_9b86cd21a3cad98788780f701d849d41_smoke-loader_wapomi.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
General
-
Target
2025-01-02_9b86cd21a3cad98788780f701d849d41_smoke-loader_wapomi.exe
-
Size
36KB
-
MD5
9b86cd21a3cad98788780f701d849d41
-
SHA1
6b8f8b74557bd6fdfa937a5aafd3edfbed94b09a
-
SHA256
740cd1b8829c401e85acfd56e9ede355785bb6386d58516ba5a1394aef27b21a
-
SHA512
0bdaed5ba48cf979bdb3a275a84c251360bc98dfddfe9f5c3bb147bcce93640a6d37c302502deadd89651707a2f6e59506c8064161aee3994cb326f76436b460
-
SSDEEP
768:aA+m41HKUpOv068E4Mf4MMRt4MtV2n5fvQGPL4vzZq2o9W7GsxBbPr:aA+m6qqOcVEP87T2n5foGCq2iW7z
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/4432-8-0x00000000005A0000-0x00000000005A9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000b000000023b8d-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation nMjr.exe -
Executes dropped EXE 1 IoCs
pid Process 4432 nMjr.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe nMjr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe nMjr.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe nMjr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe nMjr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe nMjr.exe File opened for modification C:\Program Files\Windows Mail\wab.exe nMjr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE nMjr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe nMjr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe nMjr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE nMjr.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe nMjr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE nMjr.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe nMjr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe nMjr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe nMjr.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe nMjr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe nMjr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe nMjr.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{AFD1DC19-D740-4861-ADFA-3BC6A9F6A223}\chrome_installer.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe nMjr.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe nMjr.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe nMjr.exe File opened for modification C:\Program Files\dotnet\dotnet.exe nMjr.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe nMjr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe nMjr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe nMjr.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE nMjr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe nMjr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe nMjr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe nMjr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe nMjr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe nMjr.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe nMjr.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe nMjr.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe nMjr.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe nMjr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-02_9b86cd21a3cad98788780f701d849d41_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nMjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4628 2025-01-02_9b86cd21a3cad98788780f701d849d41_smoke-loader_wapomi.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4628 wrote to memory of 4432 4628 2025-01-02_9b86cd21a3cad98788780f701d849d41_smoke-loader_wapomi.exe 83 PID 4628 wrote to memory of 4432 4628 2025-01-02_9b86cd21a3cad98788780f701d849d41_smoke-loader_wapomi.exe 83 PID 4628 wrote to memory of 4432 4628 2025-01-02_9b86cd21a3cad98788780f701d849d41_smoke-loader_wapomi.exe 83 PID 4432 wrote to memory of 1604 4432 nMjr.exe 101 PID 4432 wrote to memory of 1604 4432 nMjr.exe 101 PID 4432 wrote to memory of 1604 4432 nMjr.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-02_9b86cd21a3cad98788780f701d849d41_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-02_9b86cd21a3cad98788780f701d849d41_smoke-loader_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\nMjr.exeC:\Users\Admin\AppData\Local\Temp\nMjr.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\133335c8.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1604
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD5e2f5e54ffcb76fff9d793da52f0a1813
SHA1b17c22019adcbe80c8e05f0549fae9d634125b31
SHA256b9dd3bc7bdc771cb1136402cbf780750ab53eda613f8b8a69c6c0775704b20fc
SHA51263968e7595dfcb2f69ff14f096baad83ebb563e086cd43960c2c6a73094110f0d40bda5147edfb561e46b327107b18068cac174ac22283c06e6de6e7d1c2a5f2
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e