Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-01-2025 10:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe
-
Size
1.6MB
-
MD5
c3f837b3726f9fb607e9e200546f7c2a
-
SHA1
e81d6f7be53a204dad8d60d37170cbae1f15fdde
-
SHA256
2892ad17b1edc0ccaac8dcbb1a6023f2b187859446bc36e275a3e9d5410854b6
-
SHA512
04c4167bba7ed4e8d6df8b0960228bf68b9395017bec83389c79a19d06ea95c9bd536818723dc8e70bce28c88731f243c27999cc6066da8f56bc45c531618bb2
-
SSDEEP
49152:XE4XbjEKOh3SbiwJjn7gu5LUvdW9apuLvht/cionurM0EIMa1:Xrj834iwJjn7gu5LmMapuNiiMurM0
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2804-17-0x0000000000F50000-0x0000000000F59000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x000b000000012280-8.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2804 jtl.exe -
Loads dropped DLL 2 IoCs
pid Process 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe jtl.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe jtl.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE jtl.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe jtl.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe jtl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe jtl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe jtl.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe jtl.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe jtl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe jtl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE jtl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE jtl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE jtl.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe jtl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe jtl.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe jtl.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe jtl.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe jtl.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe jtl.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe jtl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe jtl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe jtl.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe jtl.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe jtl.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe jtl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe jtl.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe jtl.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe jtl.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe jtl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE jtl.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe jtl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe jtl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe jtl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe jtl.exe File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe jtl.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe jtl.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe jtl.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe jtl.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe jtl.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe jtl.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe jtl.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe jtl.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\inf\oem0.PNF 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe File created C:\Windows\inf\oem1.PNF 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe Token: SeRestorePrivilege 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe Token: SeRestorePrivilege 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe Token: SeRestorePrivilege 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe Token: SeRestorePrivilege 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe Token: SeRestorePrivilege 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe Token: SeRestorePrivilege 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2804 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe 31 PID 2680 wrote to memory of 2804 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe 31 PID 2680 wrote to memory of 2804 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe 31 PID 2680 wrote to memory of 2804 2680 2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe 31 PID 2804 wrote to memory of 1724 2804 jtl.exe 35 PID 2804 wrote to memory of 1724 2804 jtl.exe 35 PID 2804 wrote to memory of 1724 2804 jtl.exe 35 PID 2804 wrote to memory of 1724 2804 jtl.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-16_c3f837b3726f9fb607e9e200546f7c2a_mafia_wapomi.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\jtl.exeC:\Users\Admin\AppData\Local\Temp\jtl.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\418b1a7d.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1724
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
181B
MD5382116513fd742034f111202384ebf7d
SHA11a9202292c0c35deac1310aa90265131a65d8faa
SHA2564688c7fef49281efabfd1aca2929586798890a9af139fdd4f9afd73521d256a1
SHA5125587a186c1c9d7b3336fae4de015bc57175bbf5791ec4f8167418faffc497214c9be3d4f2bb19edf63142fb9fdebc273ca1cf7eb1d36ffa94b53963d5520e559
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e