Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2025, 17:14
Static task
static1
1 signatures
General
-
Target
Gorilla.exe
-
Size
2.6MB
-
MD5
b56d8e516dd406491e273cf22781f324
-
SHA1
3640b9ea9de0dfd688901d9aeb3628a344f749ab
-
SHA256
cbeb44540789ac8bf65368f68d9be851805fee65199d0c074a1171839b98ff12
-
SHA512
a662c1f33adcede7ce9197d1bffbceb4db75fa0abf47c0b4eddc4c1cf98c0328370121ae3f272c6d46df80a7854eb31edd1755ec6f5f7f031065af516c5a11f3
-
SSDEEP
49152:m1626Xz60rVn6QtNrDqCN03t3JPjd6idqkOkoLbr7Lbr7Lbr7LbriyCSiyCSiyC9:5j6WVn64BDqUKVZ6idqktn/
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/1516-17-0x0000000000240000-0x0000000000249000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x00190000000236dd-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation tpTGiR.exe -
Executes dropped EXE 1 IoCs
pid Process 1516 tpTGiR.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 5 raw.githubusercontent.com 6 raw.githubusercontent.com -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe tpTGiR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe tpTGiR.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE tpTGiR.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE tpTGiR.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe tpTGiR.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe tpTGiR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe tpTGiR.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe tpTGiR.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe tpTGiR.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe tpTGiR.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe tpTGiR.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe tpTGiR.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE tpTGiR.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe tpTGiR.exe File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevated_tracing_service.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe tpTGiR.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE tpTGiR.exe File opened for modification C:\Program Files\dotnet\dotnet.exe tpTGiR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe tpTGiR.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe tpTGiR.exe File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\os_update_handler.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe tpTGiR.exe File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE tpTGiR.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe tpTGiR.exe File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe tpTGiR.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe tpTGiR.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe tpTGiR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe tpTGiR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE tpTGiR.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe tpTGiR.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gorilla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpTGiR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe 4124 Gorilla.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4124 Gorilla.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4124 wrote to memory of 1516 4124 Gorilla.exe 86 PID 4124 wrote to memory of 1516 4124 Gorilla.exe 86 PID 4124 wrote to memory of 1516 4124 Gorilla.exe 86 PID 1516 wrote to memory of 5312 1516 tpTGiR.exe 105 PID 1516 wrote to memory of 5312 1516 tpTGiR.exe 105 PID 1516 wrote to memory of 5312 1516 tpTGiR.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\Gorilla.exe"C:\Users\Admin\AppData\Local\Temp\Gorilla.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\tpTGiR.exeC:\Users\Admin\AppData\Local\Temp\tpTGiR.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0e13181e.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:5312
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD55cb4750d118706b367f95228d99e7eb2
SHA1e23f061e0d485d7537292ff26574e1d1ba8fcba6
SHA256ff878da39d2e7a28c8138c5782c9b7e92dbb991732b13b85e3729c462d0672a6
SHA5126447890c702893ec72510acd8812c58c6513c8cbb37dcd0e02cfc88cd3e627a320babd64a8081452aa701de7eff52369eb2e8cef4a41c3e9e3bf329481031a68
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e