Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system -
submitted
18/04/2025, 01:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe
-
Size
2.0MB
-
MD5
5f38412e07d5697dc9c97da57395593b
-
SHA1
c71e84a02d656943952ecad34e25bd2093ddb17f
-
SHA256
3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471
-
SHA512
62436735f000bf3c32c1d2b9a858ebcddf84aebc45650a22835497b515934c023123fa8d1af781696ea9a3501bae1dcd2baae8faf24dbfe79ad4f5350a7718df
-
SSDEEP
49152:x/iXoNhoGf+wkkkZnLuy85vXukLfLqGh4vl:nGGAnLur5vX9TqA4
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/248-30-0x0000000000A60000-0x0000000000A69000-memory.dmp family_bdaejec_backdoor -
Downloads MZ/PE file 2 IoCs
flow pid Process 3 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe 3 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe -
resource yara_rule behavioral2/files/0x000b00000002ab80-3.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 248 uXmVF.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe uXmVF.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe uXmVF.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe uXmVF.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE uXmVF.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe uXmVF.exe File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\notification_helper.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe uXmVF.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE uXmVF.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe uXmVF.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe uXmVF.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe uXmVF.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE uXmVF.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE uXmVF.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Solitaire.exe uXmVF.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE uXmVF.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe uXmVF.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe uXmVF.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe uXmVF.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Cortana.exe uXmVF.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe uXmVF.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe uXmVF.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxOutlook.exe uXmVF.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe uXmVF.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe uXmVF.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe uXmVF.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe uXmVF.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe uXmVF.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\PaintApp\mspaint.exe uXmVF.exe File opened for modification C:\Program Files\7-Zip\7z.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe uXmVF.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe uXmVF.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE uXmVF.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe uXmVF.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uXmVF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5936 wmic.exe Token: SeSecurityPrivilege 5936 wmic.exe Token: SeTakeOwnershipPrivilege 5936 wmic.exe Token: SeLoadDriverPrivilege 5936 wmic.exe Token: SeSystemProfilePrivilege 5936 wmic.exe Token: SeSystemtimePrivilege 5936 wmic.exe Token: SeProfSingleProcessPrivilege 5936 wmic.exe Token: SeIncBasePriorityPrivilege 5936 wmic.exe Token: SeCreatePagefilePrivilege 5936 wmic.exe Token: SeBackupPrivilege 5936 wmic.exe Token: SeRestorePrivilege 5936 wmic.exe Token: SeShutdownPrivilege 5936 wmic.exe Token: SeDebugPrivilege 5936 wmic.exe Token: SeSystemEnvironmentPrivilege 5936 wmic.exe Token: SeRemoteShutdownPrivilege 5936 wmic.exe Token: SeUndockPrivilege 5936 wmic.exe Token: SeManageVolumePrivilege 5936 wmic.exe Token: 33 5936 wmic.exe Token: 34 5936 wmic.exe Token: 35 5936 wmic.exe Token: 36 5936 wmic.exe Token: SeIncreaseQuotaPrivilege 5936 wmic.exe Token: SeSecurityPrivilege 5936 wmic.exe Token: SeTakeOwnershipPrivilege 5936 wmic.exe Token: SeLoadDriverPrivilege 5936 wmic.exe Token: SeSystemProfilePrivilege 5936 wmic.exe Token: SeSystemtimePrivilege 5936 wmic.exe Token: SeProfSingleProcessPrivilege 5936 wmic.exe Token: SeIncBasePriorityPrivilege 5936 wmic.exe Token: SeCreatePagefilePrivilege 5936 wmic.exe Token: SeBackupPrivilege 5936 wmic.exe Token: SeRestorePrivilege 5936 wmic.exe Token: SeShutdownPrivilege 5936 wmic.exe Token: SeDebugPrivilege 5936 wmic.exe Token: SeSystemEnvironmentPrivilege 5936 wmic.exe Token: SeRemoteShutdownPrivilege 5936 wmic.exe Token: SeUndockPrivilege 5936 wmic.exe Token: SeManageVolumePrivilege 5936 wmic.exe Token: 33 5936 wmic.exe Token: 34 5936 wmic.exe Token: 35 5936 wmic.exe Token: 36 5936 wmic.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 5384 wrote to memory of 248 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe 78 PID 5384 wrote to memory of 248 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe 78 PID 5384 wrote to memory of 248 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe 78 PID 5384 wrote to memory of 5936 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe 80 PID 5384 wrote to memory of 5936 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe 80 PID 5384 wrote to memory of 5936 5384 3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe 80 PID 248 wrote to memory of 896 248 uXmVF.exe 83 PID 248 wrote to memory of 896 248 uXmVF.exe 83 PID 248 wrote to memory of 896 248 uXmVF.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe"C:\Users\Admin\AppData\Local\Temp\3628e80c7ce63cfada9ee5c4231393d0a283309e7208f12116b2295addaf8471.exe"1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Users\Admin\AppData\Local\Temp\uXmVF.exeC:\Users\Admin\AppData\Local\Temp\uXmVF.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\29286a2a.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:896
-
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic csproduct get UUID2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5936
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185B
MD50a909e37e4334dd699ac866a9057e740
SHA140110236d3330cb34a1942412ee3ab958e4816d4
SHA256b24175062a46de8cb49ec2054978a334f1d123d9093dd33084a16a7cc43ebd5c
SHA512c1dff950f5e7f72c3b9b175dc4409638b0fd52675734b22688fb38b4e003d903a77c87a34a5d956da2a04682551ef41b2a169903538e689ebe590a141c11886e
-
Filesize
10KB
MD57507092392c951194414e0c79584dc4c
SHA1ebf770ea8407e41822e791842ef035a5b554f4f4
SHA256b9800d0d009563156484d98ba80d4a35ccce199b564541829ddf6a9f4c0da780
SHA512eac6b3721e7c8cac459d80d7a73d5ae567eb9410556438c868c122dd41839630cb663157db80db2985f3b5801adf0532cdac5ad242d7e6d24169d1b32aedeb7d
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e