Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-01-2025 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe
-
Size
1.6MB
-
MD5
ed076dedbb477be876bd03d06206e2d2
-
SHA1
8647c7b1920b2ff6445ce6053f06d3da55a516f6
-
SHA256
9ba8396fc374727946ef9301a5b7d1a1e6801f23f1ae0c7389a21510f49c2b62
-
SHA512
eec23145f6859d582223cfbfe7d2f223de85317512a99fdd2023abc316f5e1afe827878defda9fa3494778c78b012249ef06e2b4d4e312a4e03267f1fc051f4e
-
SSDEEP
49152:XE4XbjEKOh3SbiwJjn7gu5LUvdW9apuLvht/cionurM0EIMa1:Xrj834iwJjn7gu5LmMapuNiiMurM0
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2340-12-0x00000000013C0000-0x00000000013C9000-memory.dmp family_bdaejec_backdoor behavioral1/memory/2340-18-0x00000000013C0000-0x00000000013C9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x00080000000120f9-4.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2340 KIBsaU.exe -
Loads dropped DLL 2 IoCs
pid Process 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE KIBsaU.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe KIBsaU.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe KIBsaU.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe KIBsaU.exe File opened for modification C:\Program Files\Windows Mail\wab.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe KIBsaU.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe KIBsaU.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{C650E966-B14F-4E38-8E3C-8BE886B090A9}\chrome_installer.exe KIBsaU.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe KIBsaU.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe KIBsaU.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe KIBsaU.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe KIBsaU.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe KIBsaU.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE KIBsaU.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe KIBsaU.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe KIBsaU.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe KIBsaU.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe KIBsaU.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe KIBsaU.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe KIBsaU.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe KIBsaU.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\inf\oem0.PNF 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe File created C:\Windows\inf\oem1.PNF 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KIBsaU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe Token: SeRestorePrivilege 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe Token: SeRestorePrivilege 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe Token: SeRestorePrivilege 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe Token: SeRestorePrivilege 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe Token: SeRestorePrivilege 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe Token: SeRestorePrivilege 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1696 wrote to memory of 2340 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe 31 PID 1696 wrote to memory of 2340 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe 31 PID 1696 wrote to memory of 2340 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe 31 PID 1696 wrote to memory of 2340 1696 2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe 31 PID 2340 wrote to memory of 1668 2340 KIBsaU.exe 35 PID 2340 wrote to memory of 1668 2340 KIBsaU.exe 35 PID 2340 wrote to memory of 1668 2340 KIBsaU.exe 35 PID 2340 wrote to memory of 1668 2340 KIBsaU.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-07_ed076dedbb477be876bd03d06206e2d2_mafia_wapomi.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\KIBsaU.exeC:\Users\Admin\AppData\Local\Temp\KIBsaU.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\231305f0.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1668
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5c8fe14150515e322ab2b87da184d3912
SHA12fb99e77ad9da3ea89d2919ee057c72370eea045
SHA25679ab87adb0c3dc813064b7c659f8c99f07f9bb23c83f382bce4075885b0ccc12
SHA51299f74e15596c97c33de310f3f4535a8fed8516bb883f1f7fcf7190ecd6bbf24819626b5553e6fa1e5b60020ebd35943b0c64027126ebb7858bf1b396ab2025bb
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e