bdaejec | b9090c730323b37898d4c126ae1a96154d49e68cd4dc1d34073d9ae9ee3d010f

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b9090c730323b37898d4c126ae1a96154d49e68cd4dc1d34073d9ae9ee3d010f.exe
Size 905KB
Sample260710-bmydbabx2p
SHA256 b9090c730323b37898d4c126ae1a96154d49e68cd4dc1d34073d9ae9ee3d010f
MD5 e4fc358c0042402658d15e6184255640
SHA1 c690f6f9a5218fc388a1cb9716ab206f1adeb14c
SHA512 89c4d1e22414896646d1e8c5be5a9dad93e8add2d3655ffe1379a1e78f0ccd054fd31c13759fcbbc3ce596e54d2f827cc23b5f9c348145b354e815fcf496c774
SSDEEP 24576:+ngHKYfXTkXy0ZE1nk/MofuU+9gDlG4Gk3:AgqKIXz21nk/M0u99gDYA3
TLSH
T14D159D05E69048F9E0EAA27C9456DA39D3777C498760D34F12E4FE533FB22939D2AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor discovery bdaejec

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/4104-40-0x00000000008E0000-0x00000000008E9000-memory.dmp	family_bdaejec_backdoor

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c48b-19.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
3644	方舟游戏文件完整性校验工具.exe
4104	GnvWP.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	GnvWP.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	GnvWP.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	GnvWP.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	GnvWP.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	GnvWP.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	GnvWP.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	GnvWP.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	GnvWP.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	GnvWP.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	GnvWP.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	GnvWP.exe
File opened for modification	C:\Program Files\Windows Defender\MpCmdRun.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	GnvWP.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	GnvWP.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\MpCmdRun.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	GnvWP.exe
File opened for modification	C:\Program Files\Windows Defender\MpDefenderCoreService.exe	GnvWP.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	GnvWP.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	GnvWP.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	GnvWP.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	GnvWP.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	GnvWP.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	GnvWP.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	GnvWP.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	GnvWP.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	GnvWP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	方舟游戏文件完整性校验工具.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GnvWP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3644	方舟游戏文件完整性校验工具.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1068	5012	b9090c730323b37898d4c126ae1a96154d49e68cd4dc1d34073d9ae9ee3d010f.exe	86
PID 1068 wrote to memory of 3304	1068	cmd.exe	88
PID 1068 wrote to memory of 3644	1068	cmd.exe	89
PID 3644 wrote to memory of 4104	3644	方舟游戏文件完整性校验工具.exe	90
PID 4104 wrote to memory of 3408	4104	GnvWP.exe	91

C:\Users\Admin\AppData\Local\Temp\b9090c730323b37898d4c126ae1a96154d49e68cd4dc1d34073d9ae9ee3d010f.exe
"C:\Users\Admin\AppData\Local\Temp\b9090c730323b37898d4c126ae1a96154d49e68cd4dc1d34073d9ae9ee3d010f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\方舟游戏文件完整性校验工具.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3304
- - C:\Users\Admin\AppData\Local\Temp\方舟游戏文件完整性校验工具.exe
    C:\Users\Admin\AppData\Local\Temp\方舟游戏文件完整性校验工具.exe C:\Users\Admin\AppData\Local\Temp\将我拖到校验工具中.md5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\GnvWP.exe
      C:\Users\Admin\AppData\Local\Temp\GnvWP.exe
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4104
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\72c26c3e.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

k2[1].rar

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WV4CZIZ0\k2[1].rar
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

11FA6A9B.exe

Path C:\Users\Admin\AppData\Local\Temp\11FA6A9B.exe
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

72c26c3e.bat

Path C:\Users\Admin\AppData\Local\Temp\72c26c3e.bat
Size 185B
SHA256 7ca00d3a9f82834c1d6c312e3c6d43fb9aab472b73d38cea4427c54207cc1a4b
MD5 5eeeb597593268afb2933d56f79534f3
SHA1 19873a5701a523a2eb14bfa1c51ece838ae553fd
SHA512 483033159419530ba81c0763cd1155ed34627f098705316811e0b891a1d68e833ef3176df92f692cb3d12ec518aa92257273be3f16dc0f8f8a06f48c14aafc02
TLSH
T12CC0124181C6C76A1494511706E5614CC469085C3B6A3B25DB20C85C719A40DF7C3351
MD5 SHA1 SHA512 TLSH

Submit Download

GnvWP.exe

Path C:\Users\Admin\AppData\Local\Temp\GnvWP.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

将我拖到校验工具中.md5

Path C:\Users\Admin\AppData\Local\Temp\将我拖到校验工具中.md5
Size 558B
SHA256 738a6aebe5de8bd96e4541f3b0773a0bc4dbcfb33f2ea7f9dbfbc3f7d006a35c
MD5 e0c84114fead360ddbe4a8de67c453f0
SHA1 a771ed32e0cade954c2dc920d2f6902aee579591
SHA512 60587d3d2b95cddefdb5a6ba4b3351ecb40428caf39a6958868cf19295287f301283805a9bd247b6f2c56caec3b3c8bce3cac87a1fe2e170489ab22f534acb65
TLSH
T1B0F0F0899ACF8789AEFCD935143C111A6B1A93F20B6090311500B8992F9607A476B1AB
MD5 SHA1 SHA512 TLSH

Submit Download

方舟游戏文件完整性校验工具.bat

Path C:\Users\Admin\AppData\Local\Temp\方舟游戏文件完整性校验工具.bat
Size 118B
SHA256 e48af9edc6a63505dee370404f24b2e73d2897d2638a7bf76d596c869dfbf831
MD5 269b1fc97c6651269932fc4522140cc1
SHA1 5b332d78a1bcbc2e44b833f64696098c8ad6eb34
SHA512 284a4eb6fbc90abe4fc163a815ad1f334d8935e502070a8a952200ade6af02aee5ae68da4a7ce836d32cfe52b18e9a103d78ba4e088e71b5db27e06329a05db5
TLSH
T18BB012370046A584301B1F867C8A339EF0C282E80B7EF940784A0245D687FBCC441022
MD5 SHA1 SHA512 TLSH

Submit Download

方舟游戏文件完整性校验工具.exe

Path C:\Users\Admin\AppData\Local\Temp\方舟游戏文件完整性校验工具.exe
Size 1.1MB
SHA256 dfd89e317898fc52d44b0a490c2efc02edb48d51d9e944edc8bc47aee9c7bd1b
MD5 1a2914af8caa3b15cf19c46a34608ba8
SHA1 b180c9c109ab6a4bc0d5f74636357dc2f394903f
SHA512 2e8baa91e9210c0965bcd222e73ab70f48a13543923a5c3e2c73ba188c95ad1fa920f555332004b538f23324710ef81f742e5e8aa42dbd4b4c19ad61873d6f81
SSDEEP 12288:ZZEUIblosRtIhUJlkHfMoJlkHfMoJlkHfM:ZoRoGtJnk/Monk/Monk/M
TLSH
T1383539807A81C8B2E5CD927CA099EB3C53576FA5EB6593CB21E4FD4335F02935C36889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3644-15-0x0000000000400000-0x0000000000519000-memory.dmp

Download

memory/3644-39-0x0000000000400000-0x0000000000519000-memory.dmp

Download

memory/4104-20-0x00000000008E0000-0x00000000008E9000-memory.dmp

Download

memory/4104-40-0x00000000008E0000-0x00000000008E9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads