bdaejec | 80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 13:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe
Size 9.9MB
Sample260903-q7mvmsvtex
SHA256 80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504
MD5 8ff6bb595abd7fbb6f37c34340c7d56f
SHA1 3a73a50899632180cb4681b8b068720e6862ca67
SHA512 05abcb70d7ee01ada537e07c0a02975778731d8800a06a09456519a4a95a2142347756075f17362a16de45a672fcc1ce8b82d16d5df10b60564e0e16ef5333f6
SSDEEP 196608:YeueXuaQ765KHOQBzZRpiZUkol9+smtbVzc3QLj9Pw8C5vtUsFm1sT3nBsxraSN3:rbWH5BTU+k++Rx/LjNsvtUsM1sT3BWaI
TLSH
T1E4A633751A41C247E77C8A740FD8FA726ECFED65D4A8E523B79139B7B630E48AA01403
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor defense_evasion discovery execution bdaejec themida trojan

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/4500-25-0x0000000000A80000-0x0000000000A89000-memory.dmp	family_bdaejec_backdoor

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c453-4.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe

Executes dropped EXE 1 IoCs

pid	Process
4500	PdlbmC.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/472-2-0x0000000000400000-0x0000000001582000-memory.dmp	themida
behavioral2/memory/472-8-0x0000000000400000-0x0000000001582000-memory.dmp	themida
behavioral2/memory/472-16-0x0000000000400000-0x0000000001582000-memory.dmp	themida
behavioral2/memory/472-17-0x0000000000400000-0x0000000001582000-memory.dmp	themida
behavioral2/memory/472-24-0x0000000000400000-0x0000000001582000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	PdlbmC.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	PdlbmC.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	PdlbmC.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	PdlbmC.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	PdlbmC.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	PdlbmC.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	PdlbmC.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	PdlbmC.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	PdlbmC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	PdlbmC.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	PdlbmC.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	PdlbmC.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	PdlbmC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4132	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PdlbmC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
472	80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe
472	80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	472	80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
472	80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe
472	80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 4500	472	80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe	89
PID 4500 wrote to memory of 4132	4500	PdlbmC.exe	91

C:\Users\Admin\AppData\Local\Temp\80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe
"C:\Users\Admin\AppData\Local\Temp\80057998f90b25442acab3a13fdb2028977bed17bacee4479c8f515eecec6504.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472
- C:\Users\Admin\AppData\Local\Temp\PdlbmC.exe
  C:\Users\Admin\AppData\Local\Temp\PdlbmC.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\64eb61b9.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

010E50A6.exe

Path C:\Users\Admin\AppData\Local\Temp\010E50A6.exe
Size 1B
SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
MD5 SHA1 SHA512

Submit Download

64eb61b9.bat

Path C:\Users\Admin\AppData\Local\Temp\64eb61b9.bat
Size 187B
SHA256 f7da1d3c189c19e376494ac99ae73214020c7fdb51d25f2ae9cc4b4f07cf6e16
MD5 089da8d6b9a2e2552677df442f2e5df1
SHA1 0360865f4e5ebfba45a07bc40e116a8976290d81
SHA512 9083aa6afd9d7750ebffa299691afb77a02be34f66710394ce4fbfb01a691b37a4db01c69d87190a60028bf1ddf8eae2d1bd5c6a3d0bb236f8b308edb39924e3
TLSH
T1DCC0120291C6C75D15A464AB07E2A18CE07A085A3BDA6B224B21845D719A40DF9C3705
MD5 SHA1 SHA512 TLSH

Submit Download

PdlbmC.exe

Path C:\Users\Admin\AppData\Local\Temp\PdlbmC.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-2-0x0000000000400000-0x0000000001582000-memory.dmp

Download

memory/472-8-0x0000000000400000-0x0000000001582000-memory.dmp

Download

memory/472-16-0x0000000000400000-0x0000000001582000-memory.dmp

Download

memory/472-17-0x0000000000400000-0x0000000001582000-memory.dmp

Download

memory/472-21-0x0000000010000000-0x00000000101CA000-memory.dmp

Download

memory/472-24-0x0000000000400000-0x0000000001582000-memory.dmp

Download

memory/4500-5-0x0000000000A80000-0x0000000000A89000-memory.dmp

Download

memory/4500-25-0x0000000000A80000-0x0000000000A89000-memory.dmp

Download