bdaejec | 73bf39628f058b73e30528f4d03c4380d6f9f7644d566db65aada296d04c857f

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe
Size 19.9MB
Sample260719-kda14afx2n
SHA256 73bf39628f058b73e30528f4d03c4380d6f9f7644d566db65aada296d04c857f
MD5 701452bcaa689252fac2fb77435723f9
SHA1 2228aa681411fc06eb4f454026056cc285c13997
SHA512 358f715dc3598f0dbc285700d354b99a420bf140d690c49e3f9be46554f23394bebfe4ef0b89dfcd0f83dc5b8e13fac5f2d80b4e52a089d8b776dc7e15741d19
SSDEEP 393216:A26TmZAFlRXesKCH9+oOrHpmpU9Y+c8EDW8xVmBWHf67C:naHRukBOr+mAK8VmU6+
TLSH
T1E62733AD0FD648EED4C11CB89B276BE713F592E6489E4C35AAC0744570B1FF1B01E2A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor bootkit defense_evasion discovery execution bdaejec persistence trojan

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 2 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/3440-7-0x0000000000400000-0x0000000000409000-memory.dmp	family_bdaejec_backdoor
behavioral2/memory/3440-16-0x0000000000400000-0x0000000000409000-memory.dmp	family_bdaejec_backdoor

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c504-3.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3440-7-0x0000000000400000-0x0000000000409000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3440-16-0x0000000000400000-0x0000000000409000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c504-3.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe

Executes dropped EXE 1 IoCs

pid	Process
3440	DoVyaU.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4932	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe
4932	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe
4932	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	DoVyaU.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	DoVyaU.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DoVyaU.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	DoVyaU.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	DoVyaU.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	DoVyaU.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\MpCmdRun.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	DoVyaU.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe	DoVyaU.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	DoVyaU.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	DoVyaU.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	DoVyaU.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DoVyaU.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	DoVyaU.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DoVyaU.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DoVyaU.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4496	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6044	4932	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DoVyaU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\WOW6432Node\CLSID\{a79189b7-d33e-0100-b970-0e6537bc}\ProdID = aca3c3101104945e0a87aea3	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\.gwe99w	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\.gwe99w\Extension (id692) = 99fd8c2af0cbc2dc120f1bec	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\WOW6432Node\CLSID\{a79189b7-d33e-0100-b970-0e6537bc}	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4932	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe
4932	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe
4932	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe
4932	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 3440	4932	2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe	89
PID 3440 wrote to memory of 4496	3440	DoVyaU.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_701452bcaa689252fac2fb77435723f9_elex_smoke-loader_wapomi.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\DoVyaU.exe
  C:\Users\Admin\AppData\Local\Temp\DoVyaU.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\43673aca.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4496
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 952
  2⤵
  - Program crash
  PID:6044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4932 -ip 4932
1⤵
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

43673aca.bat

Path C:\Users\Admin\AppData\Local\Temp\43673aca.bat
Size 187B
SHA256 2d8b8beb390b1c2c1ba9b6a82c7846d4e6aac83b0519cd2db6b8014971b052f5
MD5 efd2fd46dad892428820a842e3ac440c
SHA1 bd4ce850ae488b0b0b358cb979eb6c7c6ecf4594
SHA512 047c0cd5b71579d8a096d31d97c959676d5a0e24c56e4397ff8dba616f347a4dcf37678cc8782efb08ef6bacd53cfb78c65dcd26f8f11b04a7a62cedb88c82d1
TLSH
T1A7C01201C1D7C76E1455A05B46E1B18CC0651C583B892B114B30845CB1B6C0EBDC3741
MD5 SHA1 SHA512 TLSH

Submit Download

DoVyaU.exe

Path C:\Users\Admin\AppData\Local\Temp\DoVyaU.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3440-7-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/3440-16-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4932-6-0x0000000000400000-0x0000000003597000-memory.dmp

Download

memory/4932-8-0x0000000003710000-0x0000000003711000-memory.dmp

Download

memory/4932-9-0x0000000000400000-0x0000000003597000-memory.dmp

Download

memory/4932-15-0x0000000000400000-0x0000000003597000-memory.dmp

Download