Analysis
- max time kernel
149s - max time network
126s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/05/2026, 00:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-25_96ea37da2945ccfde6a8f2f11d458c06_elex_smoke-loader_wapomi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-05-25_96ea37da2945ccfde6a8f2f11d458c06_elex_smoke-loader_wapomi.exe
- Size 52KB
- Sample260525-a116padt3x
- SHA256 83eb1be97c4e98d4e861fac20ab977abb3f54056fe8e65f93c83f19a95d16861
- MD5 96ea37da2945ccfde6a8f2f11d458c06
- SHA1 9598ab6889a0eef4c1365141736c0fb59d1450d3
- SHA512 c2edbff34f0a0569563f99275b6cd252f3750ddbdfa938c7900a62298d15337d35223c3ed949c437cc5bd1de2395377c36b5967cd83bf9f6c7434eca0c67564e
- SSDEEP 768:R3xn2rZTK7KFr+9QGPL4vzZq2o9W7GsxBbPr:RZ2f+KGCq2iW7z
- TLSH T13F33BF1B678044B1C2DAA13009BF2BB7D6B394B05FB6AB4F0B54DD1CD8329129E7324E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Signatures
- Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/2668-15-0x0000000000450000-0x0000000000459000-memory.dmp family_bdaejec_backdoor - Custom signatureDetects executables packed with ASPack 3 IoCs
resource yara_rule behavioral2/files/0x002400000002b1de-3.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2668-4-0x0000000000450000-0x0000000000459000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2668-15-0x0000000000450000-0x0000000000459000-memory.dmp INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x002400000002b1de-3.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2668 RwEBU.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe RwEBU.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe RwEBU.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe RwEBU.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe RwEBU.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe RwEBU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe RwEBU.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\SoundRec.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe RwEBU.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\SnippingTool.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe RwEBU.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe RwEBU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe RwEBU.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe RwEBU.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe RwEBU.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe RwEBU.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe RwEBU.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\GameBar.exe RwEBU.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe RwEBU.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe RwEBU.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe RwEBU.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE RwEBU.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-25_96ea37da2945ccfde6a8f2f11d458c06_elex_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RwEBU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1028 2026-05-25_96ea37da2945ccfde6a8f2f11d458c06_elex_smoke-loader_wapomi.exe 1028 2026-05-25_96ea37da2945ccfde6a8f2f11d458c06_elex_smoke-loader_wapomi.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1028 wrote to memory of 2668 1028 2026-05-25_96ea37da2945ccfde6a8f2f11d458c06_elex_smoke-loader_wapomi.exe 80 PID 2668 wrote to memory of 2820 2668 RwEBU.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_96ea37da2945ccfde6a8f2f11d458c06_elex_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_96ea37da2945ccfde6a8f2f11d458c06_elex_smoke-loader_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\RwEBU.exeC:\Users\Admin\AppData\Local\Temp\RwEBU.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6fc52009.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2820
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\6fc52009.bat
- Size 185B
- SHA256 ac0f927112a2f0070940ee9fd985decb52102f9b1c075f705a57c400a8ecb133
- MD5 a2c2bf28096c72be41da1294e7f4ef43
- SHA1 93a936f3aba7b0f505c9f4d6b004f75b343134c7
- SHA512 b9f72989f0e55084d3ad81cc2148dc26bad172041fe6b8028028998a2448661069d2c281dcc1cdb41169fa1e16086477397ddc792d34b7fbabc317431ba097ff
- TLSH T1F4C01201C196C67918E490670AE5758EC066089C3FCD2B124B20845C619680DF5D7B41
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RwEBU.exe
- Size 15KB
- SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
- MD5 56b2c3810dba2e939a8bb9fa36d3cf96
- SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
- SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
- SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
- TLSH T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
- MD5 SHA1 SHA512 SSDEEP TLSH