bdaejec | 302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
Size 3.0MB
Sample260528-v7cf5ahs4j
SHA256 302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5
MD5 eb616b7865bcae074f4b48aab4852cab
SHA1 0afc26747eacecae999ac1a685f0565afbd38c57
SHA512 2139a78aacf7b1a45a6fc10520645d05fd13a4631fcfd72be908185c7a0c0ce37b08f457e8979105ed5598a22874148f324f843b3e443c55183dd3819acccbfb
SSDEEP 49152:RrceIb3AXqee7NioliHSm/wybo8W+31hVJxdEGCRadbQDyWTXFCx2wibWHMLc+QR:RIbwXqeA8HSGwp8W+31hVJxdj5CWowyz
TLSH
T137E5CF223AC0C036C26336365D4AF37EB2E99A301B3556C7A6941E3DBD345D3A93961F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor defense_evasion discovery bdaejec trojan

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/4136-43-0x0000000000460000-0x0000000000469000-memory.dmp	family_bdaejec_backdoor

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001700000002601f-3.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
4136	eHz.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	eHz.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	eHz.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	eHz.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	eHz.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe	eHz.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	eHz.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Music.UI.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	eHz.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	eHz.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe	eHz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	eHz.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	eHz.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	eHz.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	eHz.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	eHz.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	eHz.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	eHz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	eHz.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	eHz.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\SnippingTool.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	eHz.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	eHz.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	eHz.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe	eHz.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	eHz.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	eHz.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	eHz.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Solitaire.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2012.21.0_x64__8wekyb3d8bbwe\Calculator.exe	eHz.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	eHz.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	eHz.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	eHz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eHz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
3624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
3624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
3624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
1624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4136	3624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe	80
PID 3624 wrote to memory of 1624	3624	302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe	81
PID 4136 wrote to memory of 4788	4136	eHz.exe	83

C:\Users\Admin\AppData\Local\Temp\302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
"C:\Users\Admin\AppData\Local\Temp\302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Users\Admin\AppData\Local\Temp\eHz.exe
  C:\Users\Admin\AppData\Local\Temp\eHz.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5f746077.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4788
- F:\GOM\302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
  302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe DEL C:\Users\Admin\AppData\Local\Temp\302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

k2[1].rar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O53PBNRW\k2[1].rar
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

5f746077.bat

Path C:\Users\Admin\AppData\Local\Temp\5f746077.bat
Size 181B
SHA256 6a13da945f4383011e8cdbff84c2e67fefa2c95d316ed58612cec18b9c8d8949
MD5 522bfa53aef0dd8e28745d1c656293ff
SHA1 150cba640558baaa2fc3c87eef169c6331b0630f
SHA512 b978ae8ab77c3589d77dcab3b4aa019a46889ed3e53499c74c69ebbc7a01963424bf48c36d1428fed4f020fb2ad16deaa6a17fa8cf564b776127fe480ddbb073
TLSH
T1B8C01281C1B6C65D2854501716F1614CC079089D3F993B215B20845C619640DF5D3341
MD5 SHA1 SHA512 TLSH

Submit Download

73694EDD.exe

Path C:\Users\Admin\AppData\Local\Temp\73694EDD.exe
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

eHz.exe

Path C:\Users\Admin\AppData\Local\Temp\eHz.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe

Path F:\GOM\302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5.exe
Size 3.0MB
SHA256 302a8d3eaa03faa1573dc40f9e8266443c8a9104be61eb15cf126d3a5dc928c5
MD5 eb616b7865bcae074f4b48aab4852cab
SHA1 0afc26747eacecae999ac1a685f0565afbd38c57
SHA512 2139a78aacf7b1a45a6fc10520645d05fd13a4631fcfd72be908185c7a0c0ce37b08f457e8979105ed5598a22874148f324f843b3e443c55183dd3819acccbfb
SSDEEP 49152:RrceIb3AXqee7NioliHSm/wybo8W+31hVJxdEGCRadbQDyWTXFCx2wibWHMLc+QR:RIbwXqeA8HSGwp8W+31hVJxdj5CWowyz
TLSH
T137E5CF223AC0C036C26336365D4AF37EB2E99A301B3556C7A6941E3DBD345D3A93961F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1624-13-0x00000000002F0000-0x0000000000647000-memory.dmp

Download

memory/1624-44-0x00000000002F0000-0x0000000000647000-memory.dmp

Download

memory/3624-0-0x0000000000800000-0x0000000000B57000-memory.dmp

Download

memory/3624-12-0x0000000000800000-0x0000000000B57000-memory.dmp

Download

memory/4136-4-0x0000000000460000-0x0000000000469000-memory.dmp

Download

memory/4136-43-0x0000000000460000-0x0000000000469000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads