Analysis
-
max time kernel
107s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2025, 04:40
Static task
static1
1 signatures
General
-
Target
2025-04-07_49698061cd2fb169a3bd3aaf3a0d3aa3_bkransomware_karagany_rhadamanthys_wapomi.exe
-
Size
90KB
-
MD5
49698061cd2fb169a3bd3aaf3a0d3aa3
-
SHA1
7d7b26f72023afdefcf24c2c1a59dc654c726410
-
SHA256
709314acde77d4929f556b1dbb87efc477d0b46ec7166b04712c266c4ef925fe
-
SHA512
b92cce5003d5187ecb4eccf89cedac89ad05edbd5023740428d2dada0019ed145673fd6d5ea44013ad328ce1eb1646edff95df1bcac8d25ca009946bbc9bac4c
-
SSDEEP
1536:KJgIzEO/p3BjXV1bG5r4rW7r4tc+L19sWjcdx8KaXnGCq2iW7z:ov1/G5+L1C6LGCH
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/1324-8-0x0000000000090000-0x0000000000099000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x0009000000024168-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation XWMigU.exe -
Executes dropped EXE 1 IoCs
pid Process 1324 XWMigU.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE XWMigU.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe XWMigU.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE XWMigU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe XWMigU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe XWMigU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe XWMigU.exe File opened for modification C:\Program Files\7-Zip\7zG.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe XWMigU.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe XWMigU.exe File opened for modification C:\Program Files\Windows Mail\wab.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe XWMigU.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe XWMigU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe XWMigU.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe XWMigU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe XWMigU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe XWMigU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe XWMigU.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE XWMigU.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe XWMigU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe XWMigU.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe XWMigU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe XWMigU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe XWMigU.exe File opened for modification C:\Program Files\7-Zip\7z.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE XWMigU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe XWMigU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe XWMigU.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe XWMigU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe XWMigU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE XWMigU.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe XWMigU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe XWMigU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe XWMigU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe XWMigU.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe XWMigU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-04-07_49698061cd2fb169a3bd3aaf3a0d3aa3_bkransomware_karagany_rhadamanthys_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language XWMigU.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1324 3068 2025-04-07_49698061cd2fb169a3bd3aaf3a0d3aa3_bkransomware_karagany_rhadamanthys_wapomi.exe 88 PID 3068 wrote to memory of 1324 3068 2025-04-07_49698061cd2fb169a3bd3aaf3a0d3aa3_bkransomware_karagany_rhadamanthys_wapomi.exe 88 PID 3068 wrote to memory of 1324 3068 2025-04-07_49698061cd2fb169a3bd3aaf3a0d3aa3_bkransomware_karagany_rhadamanthys_wapomi.exe 88 PID 1324 wrote to memory of 5500 1324 XWMigU.exe 110 PID 1324 wrote to memory of 5500 1324 XWMigU.exe 110 PID 1324 wrote to memory of 5500 1324 XWMigU.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-07_49698061cd2fb169a3bd3aaf3a0d3aa3_bkransomware_karagany_rhadamanthys_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-07_49698061cd2fb169a3bd3aaf3a0d3aa3_bkransomware_karagany_rhadamanthys_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\XWMigU.exeC:\Users\Admin\AppData\Local\Temp\XWMigU.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2dab1c29.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:5500
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD598dc4fb0ba048240ab6af58e3d684944
SHA111bb821ce7e623a5777d2385b35afcad3b9f4127
SHA256a24e2191037af58e943aae0580d842f5b554df40d4a8075f05e3876a1a9fc206
SHA512fcbe2d2e24087d319445401b8c917d9f2933d6956e2f631d09bef84998cde2a6f5e2f9bb3eff278eb3fbe7d8a0454a94c3f076bc670c3c89dd369096c89b7333
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e