Analysis
-
max time kernel
74s -
max time network
76s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2025 18:19
Static task
static1
1 signatures
General
-
Target
Loader.exe
-
Size
593KB
-
MD5
7513aaaa736bf8d2b2a6d06a007fa6d2
-
SHA1
00d0077fd72d0046da42744474728b668776a1db
-
SHA256
2f2b62f010f743124767b36ed6e0c3f885a1ad0db036a65dca5f7ec20dc74919
-
SHA512
d8e0cc24274a075ea7ffd6745eb6d294de3639fcd51765499cab1966f53dff7f365325ab523280cca7b456eb23930f7776e77a968485a5f796932d4bcb424567
-
SSDEEP
12288:fmeOfxCoEB9DzYwLM8sNfuuKSmtkTGKKlmJj9//k/rTcPcYYYgYYYYYYYgYYYYYH:fxOp5uVLyqKKlmJj9//k//Ic
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/3608-22-0x0000000000E80000-0x0000000000E89000-memory.dmp family_bdaejec_backdoor -
Downloads MZ/PE file 1 IoCs
flow pid Process 53 1380 Process not Found -
resource yara_rule behavioral1/files/0x000b000000023dd9-3.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 3608 ZavQTq.exe 748 vlc.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe ZavQTq.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe ZavQTq.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE ZavQTq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE ZavQTq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe ZavQTq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe ZavQTq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe ZavQTq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe ZavQTq.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe ZavQTq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe ZavQTq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE ZavQTq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe ZavQTq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe ZavQTq.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe ZavQTq.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe ZavQTq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe ZavQTq.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe ZavQTq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe ZavQTq.exe File opened for modification C:\Program Files\7-Zip\7zG.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe ZavQTq.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE ZavQTq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe ZavQTq.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe ZavQTq.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe ZavQTq.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe ZavQTq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe ZavQTq.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe ZavQTq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ZavQTq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4272 MicrosoftEdgeUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 748 vlc.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 748 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4976 Loader.exe Token: SeDebugPrivilege 4636 taskmgr.exe Token: SeSystemProfilePrivilege 4636 taskmgr.exe Token: SeCreateGlobalPrivilege 4636 taskmgr.exe Token: 33 4636 taskmgr.exe Token: SeIncBasePriorityPrivilege 4636 taskmgr.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe -
Suspicious use of SendNotifyMessage 54 IoCs
pid Process 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 748 vlc.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe 4636 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 748 vlc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4976 wrote to memory of 3608 4976 Loader.exe 88 PID 4976 wrote to memory of 3608 4976 Loader.exe 88 PID 4976 wrote to memory of 3608 4976 Loader.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\ZavQTq.exeC:\Users\Admin\AppData\Local\Temp\ZavQTq.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3608
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ShowTest.AAC"1⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:748
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTFDMTRDMzItNkUyRS00MDU5LTgzMEMtNUFBREM3N0U4MTNCfSIgdXNlcmlkPSJ7RjE3NzU3Q0YtRjQzMS00Q0VCLUFBNEItQThGN0MxODAzMDVDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7ODFGODkzNUUtRTFGRS00NjUzLTkzMDYtRThBMzY2QkQzRjFBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI2IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjU3OTM3Mzg2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4272
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
966KB
MD53740507a1dc4ff4cb5c6e52652c10c20
SHA1b2c8a0a736fe81c101f4ab4cd6be8099c3f902b3
SHA2566a72cc8649a63b017844c4c1f3885a250d1a982ffe5f1e58b6f1432fe9198e62
SHA512d5299859a6121c6ae5813be61648ca1f005970ebe34a8217d05b570ffbd4651f64ad7b3a7bf5129e708e07b36e097333f754b213e73d5fe9246347afd8fa3c22
-
Filesize
4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e