Analysis
-
max time kernel
128s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2025 20:48
Behavioral task
behavioral1
Sample
nCbq.exe
Resource
win7-20241023-en
windows7-x64
20 signatures
150 seconds
General
-
Target
nCbq.exe
-
Size
15KB
-
MD5
56b2c3810dba2e939a8bb9fa36d3cf96
-
SHA1
99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
-
SHA256
4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
-
SHA512
27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
SSDEEP
384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/2480-9-0x00000000008B0000-0x00000000008B9000-memory.dmp family_bdaejec_backdoor -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation nCbq.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe nCbq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE nCbq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe nCbq.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe nCbq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe nCbq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe nCbq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe nCbq.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe nCbq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe nCbq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe nCbq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe nCbq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe nCbq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe nCbq.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe nCbq.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe nCbq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe nCbq.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe nCbq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe nCbq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe nCbq.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe nCbq.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE nCbq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe nCbq.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe nCbq.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe nCbq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe nCbq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe nCbq.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe nCbq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe nCbq.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe nCbq.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe nCbq.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe nCbq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe nCbq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe nCbq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe nCbq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe nCbq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe nCbq.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe nCbq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe nCbq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nCbq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2480 wrote to memory of 3944 2480 nCbq.exe 87 PID 2480 wrote to memory of 3944 2480 nCbq.exe 87 PID 2480 wrote to memory of 3944 2480 nCbq.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\nCbq.exe"C:\Users\Admin\AppData\Local\Temp\nCbq.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2e851a0e.bat" "2⤵
- System Location Discovery: System Language Discovery
PID:3944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD5e88747374cf2e1be8c3ca1ff49a20a5c
SHA17af83d3899522ed5d0188db9ebdac629ad2922fc
SHA2564da887eaf7872670481e1c4a8cdf57e6ee83c14f7483842794ac7d5274447481
SHA5121eafd4a9fbb21cfba2ab5740b1906e1e2fbadbc1290a3dc57200a82b0ec2e8a3355c2be793fdc24b34ff1e93dd7b9f58526602ef032e21e87fc37b2e314c1265