bdaejec | 545aa463a18bdd6dc65a3fe14c5c274c778ce428498f6f9eb4efef78faf213d3

Analysis

max time kernel
106s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2025 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe
Size

4.5MB
MD5

fd5152c90190eb2905a4843bba0f0203
SHA1

c054c6371e39785df6ffd19603c7b33c4abc9664
SHA256

545aa463a18bdd6dc65a3fe14c5c274c778ce428498f6f9eb4efef78faf213d3
SHA512

1f174cc1c509a499bdaff9d697d800633b51d81abe81c12f4589401c5f80ff89b05caa80baac8361252d7d44aafed99c40e38ab11404c6a1379e8171fac82cfd
SSDEEP

98304:+9Kowl90E9mSBixvXDESNYMnVfgmtghRvUiFrJsWTc:+9Ko9yMnVfgvDvUEs

Score

10^/10

bdaejec aspackv2 backdoor defense_evasion discovery themida trojan

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec
Bdaejec family
bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/2060-9-0x0000000000530000-0x0000000000539000-memory.dmp	family_bdaejec_backdoor

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0008000000023ca3-3.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe

Executes dropped EXE 1 IoCs

pid	Process
2060	DMOSFD.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/5056-0-0x0000000000400000-0x0000000000898000-memory.dmp	themida
behavioral2/memory/5056-8-0x0000000000400000-0x0000000000898000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5056	2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	DMOSFD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	DMOSFD.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateComRegisterShell64.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	DMOSFD.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	DMOSFD.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	DMOSFD.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateOnDemand.exe	DMOSFD.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DMOSFD.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe	DMOSFD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DMOSFD.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	DMOSFD.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	DMOSFD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DMOSFD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	DMOSFD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe	DMOSFD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe	DMOSFD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	DMOSFD.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	DMOSFD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DMOSFD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DMOSFD.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	DMOSFD.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe	DMOSFD.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DMOSFD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	DMOSFD.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	DMOSFD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	DMOSFD.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DMOSFD.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	DMOSFD.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	DMOSFD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DMOSFD.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5056	2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe
5056	2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 2060	5056	2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe	83
PID 5056 wrote to memory of 2060	5056	2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe	83
PID 5056 wrote to memory of 2060	5056	2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe	83

C:\Users\Admin\AppData\Local\Temp\2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-29_fd5152c90190eb2905a4843bba0f0203_smoke-loader_wapomi.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\DMOSFD.exe
  C:\Users\Admin\AppData\Local\Temp\DMOSFD.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2fc72804.bat" "
    3⤵
    PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2fc72804.bat

Filesize
187B

MD5
caa5b26e8106cea728345e93ebd9685d

SHA1
e61ed8ddae9358079f705e38f6e7b12ab405f72a

SHA256
ee361e57a66a16e270ba8d5d26dc0ba32221630064449da7389860e251c1b72f

SHA512
8bb611175b8dabeb5db5ae57cda359249fe5744c6d063cce4461871c5b73b7c165415865423aacd6c952912338ef77dab44a4ba08fd7ced29fb0843ade22725d

Download Submit
C:\Users\Admin\AppData\Local\Temp\DMOSFD.exe

Filesize
15KB

MD5
56b2c3810dba2e939a8bb9fa36d3cf96

SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

Download Submit
memory/2060-4-0x0000000000530000-0x0000000000539000-memory.dmp

Filesize
36KB

Download
memory/2060-9-0x0000000000530000-0x0000000000539000-memory.dmp

Filesize
36KB

Download
memory/5056-0-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download
memory/5056-7-0x00000000772F4000-0x00000000772F6000-memory.dmp

Filesize
8KB

Download
memory/5056-8-0x0000000000400000-0x0000000000898000-memory.dmp

Filesize
4.6MB

Download