Overview

overview

10

Static

static

3

2026-08-22...mi.exe

windows10-2004-x64

10

2026-08-22...mi.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-22_e4f9c80947ada06ad1839327050c9232_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi.exe
  • Size 8.1MB
  • Sample260822-2b2jpscm5v
  • SHA256 81c511437a996ab6720c8dd8c6eee5a77fdf61b9e87ad8b32f47063b58f1e584
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwareaspackv2backdoordiscoveryexecutionbdaejecpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Family

  • bdaejec

C2

  • ddos.dnsnb8.net

Signatures

  • Family: Bdaejec

    Bdaejec is a backdoor written in C++.

    backdoorbdaejec
  • Detects Bdaejec Backdoor. 1 IoCs

    Bdaejec is backdoor written in C++.

  • Detects executables packed with ASPack 3 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_e4f9c80947ada06ad1839327050c9232_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_e4f9c80947ada06ad1839327050c9232_elex_manuscrypt_redline-stealer_rhadamanthys_smoke-loader_stop_wapomi.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5772
    • C:\Users\Admin\AppData\Local\Temp\aHoFIt.exe
      C:\Users\Admin\AppData\Local\Temp\aHoFIt.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6100
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\008511e2.bat" "
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:3428
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe /i "C:\ProgramData\ClassicShellSetup64_3_6_8.msi"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Program Files\Classic Shell\ClassicStartMenu.exe
        "C:\Program Files\Classic Shell\ClassicStartMenu.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3164
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2240
      • C:\Windows\syswow64\MsiExec.exe
        "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\Classic Shell\ClassicExplorer32.dll"
        2⤵
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1156
      • C:\Windows\syswow64\MsiExec.exe
        "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll"
        2⤵
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5236
      • C:\Windows\System32\MsiExec.exe
        "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Classic Shell\ClassicExplorer64.dll"
        2⤵
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3640
      • C:\Windows\System32\MsiExec.exe
        "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll"
        2⤵
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3916
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 97242E10BA73CBD2AD106230CD3AC068 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1716
        • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
          "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Program Files\Classic Shell\ClassicShellReadme.rtf" /o ""
          3⤵
          • Executes dropped EXE
          • Checks system information in the registry
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SetWindowsHookEx
          PID:5800
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:5524
    • C:\Program Files\Classic Shell\ClassicShellService.exe
      "C:\Program Files\Classic Shell\ClassicShellService.exe"
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3280
      • C:\Program Files\Classic Shell\ClassicStartMenu.exe
        "C:\Program Files\Classic Shell\ClassicStartMenu.exe" -startup
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:5884
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:4344

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a0b8b.rbs
          • Path C:\Config.Msi\e5a0b8b.rbs
          • Size 16KB
          • SHA256 d726451d56f7aef6bb7f75a8563419eee43f51c394bcdce21fb08d98d24d6342
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ClassicExplorer32.dll
          • Path C:\Program Files\Classic Shell\ClassicExplorer32.dll
          • Size 580KB
          • SHA256 a936484766fafd1174c1b76e633efafa49eb671900b556e0d584b4bb7cf6933d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ClassicExplorer64.dll
          • Path C:\Program Files\Classic Shell\ClassicExplorer64.dll
          • Size 708KB
          • SHA256 f6a78d0678601f20ffe85e86d832aaa2827b1ed6f7558efc8cfcff84434866b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ClassicIE9DLL_32.dll
          • Path C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll
          • Size 359KB
          • SHA256 ef5ccda284307cbe0e243bcaecf0464ca57fbac7a8122fe1cea2bb64ecb97be6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ClassicIE9DLL_64.dll
          • Path C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll
          • Size 427KB
          • SHA256 1a2c392e3f829dffb260fa421c9c5b002b147da5568410d6af819f4493680fb2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ClassicIE9_32.exe
          • Path C:\Program Files\Classic Shell\ClassicIE9_32.exe
          • Size 97KB
          • SHA256 ec5596d80ac41c1b8ee36d09e06557dfebd39af5195aa7df56146824556b5b26
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ClassicShellReadme.rtf
          • Path C:\Program Files\Classic Shell\ClassicShellReadme.rtf
          • Size 97KB
          • SHA256 88f73687b8019d78cd42bb7f548629c631b4eb58d67239335fa4d8251b04fe32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ClassicShellService.exe
          • Path C:\Program Files\Classic Shell\ClassicShellService.exe
          • Size 67KB
          • SHA256 b62bfd973949e64f408058d8590ee1bd899ecb11139f3e3b7d6448566161c2d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ClassicStartMenu.exe
          • Path C:\Program Files\Classic Shell\ClassicStartMenu.exe
          • Size 148KB
          • SHA256 8732a13f0964571857065be6446b2c00d894992dad20d4e26e661ed95e412ba5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ClassicStartMenuDLL.dll
          • Path C:\Program Files\Classic Shell\ClassicStartMenuDLL.dll
          • Size 1.7MB
          • SHA256 8e4e4879bb7b4993b9aa8b493ffbed1a1486cdc76916f7c7c9f274047cfce5ae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ExplorerL10N.ini
          • Path C:\Program Files\Classic Shell\ExplorerL10N.ini
          • Size 40KB
          • SHA256 1ab64f8c262396a934cb78489537ebee6c4970743a2ee8043417df2aa73dad9c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          StartMenuL10N.ini
          • Path C:\Program Files\Classic Shell\StartMenuL10N.ini
          • Size 113KB
          • SHA256 14e455149b63c333d8bcb7132bbbb2dba529ed3224805d2874ebce279b170293
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WINWORD.EXE
          • Path C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
          • Size 1.9MB
          • SHA256 74de25834cbfeb41c3053bf976f958dbe27def7b2e4d1e11d7d7d05f3700529c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ClassicShellSetup64_3_6_8.msi
          • Path C:\ProgramData\ClassicShellSetup64_3_6_8.msi
          • Size 4.2MB
          • SHA256 f27d379d272972a9d4db4e2d60389dcafea30e91b764e419dc783b1c0a8658f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          008511e2.bat
          • Path C:\Users\Admin\AppData\Local\Temp\008511e2.bat
          • Size 187B
          • SHA256 f9be7b433cee61d2cad9de0046af3529ea84fb7f17d1ee6027cb7823cdc6955b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI2BF3.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI2BF3.tmp
          • Size 148KB
          • SHA256 fa9b83479f1b955790325dc557624185a8c72df3e31870dae075437146858185
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          gb.xsl
          • Path C:\Users\Admin\AppData\Local\Temp\TCD72DA.tmp\gb.xsl
          • Size 262KB
          • SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          aHoFIt.exe
          • Path C:\Users\Admin\AppData\Local\Temp\aHoFIt.exe
          • Size 15KB
          • SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          index.dat
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
          • Size 399B
          • SHA256 256dca96ae57fec3978a2d6c4da7cd7389e8bf6dbe87264925fad9e21d3ed736
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          fb3b0dbfee58fac8.customDestinations-ms
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          • Size 2KB
          • SHA256 e7b3ab33387a6ce6de619c0db49dbcb2eb27092e2b3b3a5a0e4b512c395a3d1c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          fb3b0dbfee58fac8.customDestinations-ms
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
          • Size 3KB
          • SHA256 65792d4ed3abbbe05fa68cd2d1e4adf0d555bc6923e64ae9425739ad595840d3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 8f45e468d4ec8665a3f0a76d951708f3b08d903b3860e339c012c949daf91876
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {56051876-8a3d-46e8-a2a1-f67c00b1e6e1}_OnDiskSnapshotProp
          • Path \??\Volume{ca73a981-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{56051876-8a3d-46e8-a2a1-f67c00b1e6e1}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 95760db7fc8d9b99dcf7fc86cf06cd7631f6d009e258676bc6205156e864b944
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/5772-10-0x0000000000270000-0x0000000000A86000-memory.dmp
          Download

          memory/5772-2-0x0000000000270000-0x0000000000A86000-memory.dmp
          Download

          memory/5772-114-0x0000000000270000-0x0000000000A86000-memory.dmp
          Download

          memory/5800-113-0x00007FF7E1880000-0x00007FF7E1890000-memory.dmp
          Download

          memory/5800-116-0x00007FF7DEC70000-0x00007FF7DEC80000-memory.dmp
          Download

          memory/5800-115-0x00007FF7DEC70000-0x00007FF7DEC80000-memory.dmp
          Download

          memory/5800-109-0x00007FF7E1880000-0x00007FF7E1890000-memory.dmp
          Download

          memory/5800-110-0x00007FF7E1880000-0x00007FF7E1890000-memory.dmp
          Download

          memory/5800-112-0x00007FF7E1880000-0x00007FF7E1890000-memory.dmp
          Download

          memory/5800-111-0x00007FF7E1880000-0x00007FF7E1890000-memory.dmp
          Download

          memory/6100-5-0x0000000000C80000-0x0000000000C89000-memory.dmp
          Download

          memory/6100-11-0x0000000000C80000-0x0000000000C89000-memory.dmp
          Download