bdaejec | cce38f2321130ca2eeaec596f78e53c572c3966fae273e4c906f6cb4829251a1

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Size 1.6MB
Sample260802-qlhnsstdma
SHA256 cce38f2321130ca2eeaec596f78e53c572c3966fae273e4c906f6cb4829251a1
MD5 fd99fce2a9578c359e984a90ce011b30
SHA1 39ddbde028491171785c4ec31d6b85c9a15a20da
SHA512 13936134861227ec4b923225008efb165c31ac7fb07c52b9e01d038eed9b6ef9190199f00b6634e25645e3c117c550c76d42c0441e86d363243817d42e4c0634
SSDEEP 49152:XE4XbjEKOh3SbiwJjn7gu5LUvdW9apuLvht/cionurM0EIMa1:Xrj834iwJjn7gu5LmMapuNiiMurM0
TLSH
T1BF759D3136908077C67B32319B9AA3FDB6F9A5304D35524B56A10E3C2E709D3A92C76F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor discovery execution bdaejec

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/3884-10-0x00000000008D0000-0x00000000008D9000-memory.dmp	family_bdaejec_backdoor

Detects executables packed with ASPack 3 IoCs

resource	yara_rule
behavioral2/files/0x0008000000016cdf-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3884-5-0x00000000008D0000-0x00000000008D9000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3884-10-0x00000000008D0000-0x00000000008D9000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0008000000016cdf-4.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3884	MeIjy.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	MeIjy.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	MeIjy.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	MeIjy.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	MeIjy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	MeIjy.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe	MeIjy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	MeIjy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	MeIjy.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	MeIjy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	MeIjy.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	MeIjy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	MeIjy.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	MeIjy.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	MeIjy.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	MeIjy.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	MeIjy.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	MeIjy.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	MeIjy.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	MeIjy.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	MeIjy.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	MeIjy.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	MeIjy.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	MeIjy.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	MeIjy.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	MeIjy.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\inf\oem0.PNF	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2740	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MeIjy.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 3884	476	2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe	90
PID 3884 wrote to memory of 2740	3884	MeIjy.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_fd99fce2a9578c359e984a90ce011b30_darkgate_elex_mafia_smoke-loader_wapomi.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:476
- C:\Users\Admin\AppData\Local\Temp\MeIjy.exe
  C:\Users\Admin\AppData\Local\Temp\MeIjy.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\79cb118d.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

79cb118d.bat

Path C:\Users\Admin\AppData\Local\Temp\79cb118d.bat
Size 185B
SHA256 0bcab99cfe16c63fe1f88795413a8633bd32448da21fef29a33a924f7a50cf55
MD5 3d708945617d31e6e053db7d81797564
SHA1 eb4a4b518d3d1cb21035bd2204b665920c905da2
SHA512 2c69dd7f462ec024ae90bde7a3dd1695ec14bbc63b37b0bfe6237d80022562392ad4c89dbfcf7720de3bc1256b998518c2df383549801f726e4d164ff5654fc1
TLSH
T119C01211C186C66D14A4901716E1714DD0754C9C3F8D3F218B21C45CA19680DBDC3381
MD5 SHA1 SHA512 TLSH

Submit Download

MeIjy.exe

Path C:\Users\Admin\AppData\Local\Temp\MeIjy.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/476-0-0x0000000000950000-0x0000000000AFB000-memory.dmp

Download

memory/476-9-0x0000000000950000-0x0000000000AFB000-memory.dmp

Download

memory/3884-5-0x00000000008D0000-0x00000000008D9000-memory.dmp

Download

memory/3884-10-0x00000000008D0000-0x00000000008D9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads