bdaejec | 12caf17b481c8ad6ce260aa0668d64a0389e9d376bb5720f84449d370833ffc2

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
Size 32KB
Sample260804-ly5a4sxcmc
SHA256 12caf17b481c8ad6ce260aa0668d64a0389e9d376bb5720f84449d370833ffc2
MD5 bdbc0fc74d714716aeed5802545dc6d8
SHA1 2fa2e9af035acf5df0e7716e2891389735260fa6
SHA512 e9c459947fed0d4fb810bfd0dd31e5fa2d47a44b41020d9e31816f9068b2af119317ac76dfe7b9914a3f8dd37ff05492b5a0c593d01ecaf069705ebfd9f9dcf1
SSDEEP 768:bQGPL4vzZq2o9W7GsxBbPr8TQGPL4vzZq2o9W7GsxBbPr:cGCq2iW7zQEGCq2iW7z
TLSH
T1C5E2BFF28FC098FFC4CD353350863687CB7B4670DABA75BF82618867289AE05EC65495
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor discovery execution bdaejec

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/5008-10-0x0000000000830000-0x0000000000839000-memory.dmp	family_bdaejec_backdoor

Detects executables packed with ASPack 5 IoCs

resource	yara_rule
behavioral2/memory/5996-0-0x00000000004F0000-0x00000000004FE000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d000000016cdc-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5008-5-0x0000000000830000-0x0000000000839000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5996-9-0x00000000004F0000-0x00000000004FE000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5008-10-0x0000000000830000-0x0000000000839000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d000000016cdc-4.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5008	bRNLGk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	bRNLGk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	bRNLGk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	bRNLGk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	bRNLGk.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	bRNLGk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	bRNLGk.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	bRNLGk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	bRNLGk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1968	cmd.exe
3876	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bRNLGk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 5008	5996	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe	89
PID 5996 wrote to memory of 1968	5996	2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe	91
PID 5008 wrote to memory of 3876	5008	bRNLGk.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_bdbc0fc74d714716aeed5802545dc6d8_elex_smoke-loader_wapomi.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Users\Admin\AppData\Local\Temp\bRNLGk.exe
  C:\Users\Admin\AppData\Local\Temp\bRNLGk.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3a845e34.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\35326201.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 31KB
SHA256 421f6bbd1c17f8da83a5a7fd3a4e70e928da56e6043bef9c3218b018f2a614e1
MD5 c8c49f5a34c8cf88fe9eddf021e1610a
SHA1 47da6f78aed49f621069df8a26336cd6ef0e8565
SHA512 77d39a5aed545936a67d5fbc1609689e602a97bbd7cb923fb01abe99609aa2b50337e83f913f1e48354644a46a1baf70602431d06aff88441925166834abaa8c
SSDEEP 768:6WQ3655Kv1KjqY1MNHxDQGPL4vzZq2o9W7GsxBbPr:6HqaN6qHxUGCq2iW7z
TLSH
T11FE28D53CF9054F6F7EF253160FA3A478AB7AD2089A4EE5F83707A9D1C34600E866257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35326201.bat

Path C:\Users\Admin\AppData\Local\Temp\35326201.bat
Size 311B
SHA256 4a93b05b437568bf8ff5475770bf66d422ec85bd8de597363ff0dce347ffed1d
MD5 d7d5917e0204c6df9f5aadd9dd536b6a
SHA1 6207012f66928431c56a37f2f9e22e01c0b7869e
SHA512 2546c48a4055501430578b21d51476698019a6fd29e21611dc2b40f0f0b1dc05d5ad14b137661eb0b27fbdd34103c2d7bb977ca29a39ac2ef48dbb28bdd82395
TLSH
T1EBE0CD3284ABCE1715A6D51795E028CC82653F1D2F5D67355720C4AF90D548DF4E3502
MD5 SHA1 SHA512 TLSH

Submit Download

3a845e34.bat

Path C:\Users\Admin\AppData\Local\Temp\3a845e34.bat
Size 187B
SHA256 4e2898099305df9b1b40cade314a2b53c4781edecef2f0ab0e159552a3002a8c
MD5 79c60d3ddec65c39f10d40ffb9411457
SHA1 6ff065de38f0c9e56d2dce12ec5e5ce2a306a70a
SHA512 59930a1956f4be93f799f814b63c8103761a9dfb7759b18167a6b7b942eff4f67dd825d88a37f62310e7dc9e6ef48de57ad22620e566ff3c483c7ec5a3743a3c
TLSH
T19EC0120181DFC6AD245854270AE5618CD1A54C5C3B8D2B155F30C45D719640DB6D3341
MD5 SHA1 SHA512 TLSH

Submit Download

bRNLGk.exe

Path C:\Users\Admin\AppData\Local\Temp\bRNLGk.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5008-5-0x0000000000830000-0x0000000000839000-memory.dmp

Download

memory/5008-10-0x0000000000830000-0x0000000000839000-memory.dmp

Download

memory/5996-0-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

memory/5996-9-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads