Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-01-2025 02:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe
-
Size
1.6MB
-
MD5
9457fa9d414d74dfde88bd3dbcf017fc
-
SHA1
e5f87ae95c550c4921043a3494547eb056d43844
-
SHA256
b06cea6ff0a02691ad5b18f60d82729d28e16da1bbf553a4c1c346062cf6bb7c
-
SHA512
2c2f5f8ebb0a607791a40e8d2c4b50446d588fce6c6233b2063dc52db499ce388903149e5ed145bb4248290a4e585c6e979c524afaa6bd473dc5a91fdd3f5ec7
-
SSDEEP
49152:XE4XbjEKOh3SbiwJjn7gu5LUvdW9apuLvht/cionurM0EIMa1:Xrj834iwJjn7gu5LmMapuNiiMurM0
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/1900-11-0x0000000000CC0000-0x0000000000CC9000-memory.dmp family_bdaejec_backdoor behavioral1/memory/1900-18-0x0000000000CC0000-0x0000000000CC9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x00090000000120d6-12.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1900 gJWXZM.exe -
Loads dropped DLL 2 IoCs
pid Process 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE gJWXZM.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe gJWXZM.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe gJWXZM.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe gJWXZM.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe gJWXZM.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe gJWXZM.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE gJWXZM.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE gJWXZM.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe gJWXZM.exe File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe gJWXZM.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe gJWXZM.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe gJWXZM.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe gJWXZM.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE gJWXZM.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe gJWXZM.exe File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe gJWXZM.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe gJWXZM.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe gJWXZM.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe gJWXZM.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE gJWXZM.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\inf\oem0.PNF 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe File created C:\Windows\inf\oem1.PNF 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gJWXZM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe Token: SeRestorePrivilege 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe Token: SeRestorePrivilege 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe Token: SeRestorePrivilege 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe Token: SeRestorePrivilege 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe Token: SeRestorePrivilege 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe Token: SeRestorePrivilege 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1900 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe 29 PID 1996 wrote to memory of 1900 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe 29 PID 1996 wrote to memory of 1900 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe 29 PID 1996 wrote to memory of 1900 1996 2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe 29 PID 1900 wrote to memory of 1792 1900 gJWXZM.exe 34 PID 1900 wrote to memory of 1792 1900 gJWXZM.exe 34 PID 1900 wrote to memory of 1792 1900 gJWXZM.exe 34 PID 1900 wrote to memory of 1792 1900 gJWXZM.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_9457fa9d414d74dfde88bd3dbcf017fc_mafia_wapomi.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\gJWXZM.exeC:\Users\Admin\AppData\Local\Temp\gJWXZM.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\11175abc.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1792
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD58b52eb7041404d04975a83075889488b
SHA1667cd88e7aea86131532ccaaba6e4abec4c53a00
SHA256fd530cfb57cfff33db8f90eba6fd69c0804fcf42ec5babccf00244e138c06029
SHA512a469ee47b7efd11c2b3ce1050b9b77a59223b0d1a8133ff66b9b686ba00c8569bbd215c537802692ea6b30ef5c933653a1d1f49a82b176dc6011c894c879fa1a
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e