Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-01-2025 03:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
General
-
Target
2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe
-
Size
2.6MB
-
MD5
e72d97d54f3e18736288f7e7525c845c
-
SHA1
3eef895cea250b6227533cb0bf609e5f82df2a02
-
SHA256
a9c62d60ac815ff4e698b68fddaa2444353f6cd8679737662019a1a995f5a31b
-
SHA512
c8f8f5ea6094e0f94da4ffa496910a9b03ca70d8d06cdba794afb72ff7a19be44d58a39899eddc6715500416f82d0e3a25902e646dff8a8a52ea6ade5d553cd6
-
SSDEEP
12288:Lq4tplxDCUlt77RXQzOP/rZRbjLCJM/dSSSSS4LKZWuIm:LfldZ7RqeHLrPuIm
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 2 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2764-11-0x0000000000030000-0x0000000000039000-memory.dmp family_bdaejec_backdoor behavioral1/memory/2764-68-0x0000000000030000-0x0000000000039000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x0007000000012115-8.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2764 OLUd.exe -
Loads dropped DLL 17 IoCs
pid Process 2380 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe 2380 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found 1212 Process not Found -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\N: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\U: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\W: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\X: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\J: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\M: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\P: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\Q: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\Z: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\V: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\E: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\K: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\L: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\O: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\R: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\G: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\H: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\S: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\T: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe File opened (read-only) \??\Y: 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe OLUd.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe OLUd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe OLUd.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe OLUd.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe OLUd.exe File opened for modification C:\Program Files\Windows Mail\WinMail.exe OLUd.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe OLUd.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe OLUd.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe OLUd.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe OLUd.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe OLUd.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe OLUd.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe OLUd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE OLUd.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe OLUd.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe OLUd.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe OLUd.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe OLUd.exe File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe OLUd.exe File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe OLUd.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe OLUd.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE OLUd.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe OLUd.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe OLUd.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe OLUd.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe OLUd.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe OLUd.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe OLUd.exe File opened for modification C:\Program Files\Windows Mail\wab.exe OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE OLUd.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE OLUd.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe OLUd.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe OLUd.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe OLUd.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE OLUd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE OLUd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OLUd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2380 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2380 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe 2380 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe 2380 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2764 2380 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe 30 PID 2380 wrote to memory of 2764 2380 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe 30 PID 2380 wrote to memory of 2764 2380 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe 30 PID 2380 wrote to memory of 2764 2380 2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe 30 PID 2764 wrote to memory of 1640 2764 OLUd.exe 32 PID 2764 wrote to memory of 1640 2764 OLUd.exe 32 PID 2764 wrote to memory of 1640 2764 OLUd.exe 32 PID 2764 wrote to memory of 1640 2764 OLUd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-21_e72d97d54f3e18736288f7e7525c845c_smoke-loader_wapomi.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\OLUd.exeC:\Users\Admin\AppData\Local\Temp\OLUd.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\02fa06ba.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1640
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WUBCGJ0A\k2[1].rar
Filesize4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
183B
MD53aafd7904cf9ab9c58c622bb969bab32
SHA19f08179ed7453e89c8b83347b5b34a5d71be957a
SHA2568ee4003660292063484e0b53e6c3ac9c54e842473e084f4b3453d28ee9482af5
SHA5121ed3cb60cec703af90170fe1417fda496f5ec58f02503f4423dfa441ea6edd587d863289464f140617f29854ffa357272bfc61d8995c3a6e38a23f1aed84303e
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
Filesize
2.8MB
MD5095092f4e746810c5829038d48afd55a
SHA1246eb3d41194dddc826049bbafeb6fc522ec044a
SHA2562f606012843d144610dc7be55d1716d5d106cbc6acbce57561dc0e62c38b8588
SHA5127f36fc03bfed0f3cf6ac3406c819993bf995e4f8c26a7589e9032c14b5a9c7048f5567f77b3b15f946c5282fc0be6308a92eab7879332d74c400d0c139ce8400
-
Filesize
654KB
MD51fd347ee17287e9c9532c46a49c4abc4
SHA1ad5d9599030bfbcc828c4321fffd7b9066369393
SHA256912373af6f3c176b7e0a71c986d6288f76f5be80de7c9a580b110690271e9237
SHA5129e52622077e805fcff2c6fe510524bf9ca7246da9ef42843041e82ced28b59163a2729335139df9e2d2a4c748ed56471bb053f337655a77d2d0976370f07acf4
-
Filesize
966KB
MD53740507a1dc4ff4cb5c6e52652c10c20
SHA1b2c8a0a736fe81c101f4ab4cd6be8099c3f902b3
SHA2566a72cc8649a63b017844c4c1f3885a250d1a982ffe5f1e58b6f1432fe9198e62
SHA512d5299859a6121c6ae5813be61648ca1f005970ebe34a8217d05b570ffbd4651f64ad7b3a7bf5129e708e07b36e097333f754b213e73d5fe9246347afd8fa3c22