bdaejec | 7138a784b6181776bf9a74eaa51f357d2eb3a6e6a806aa82a797f5865a97f7bf

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/09/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
Size 32KB
Sample260904-narffshj6v
SHA256 7138a784b6181776bf9a74eaa51f357d2eb3a6e6a806aa82a797f5865a97f7bf
MD5 3780a5c4393d08438309a053f55e755d
SHA1 ff73f1827a275452a13cb21ccaac6845d84c661c
SHA512 7d73cf89f91baff51edd7dd0ed9db9639d4462f574eeedf6bab3132b1d44af00dab939cbe9d65c4a6d487ee1e37c200acada6ae4bcf383c840c63203c17acab1
SSDEEP 768:bQGPL4vzZq2o9W7GsxBbPr1tQGPL4vzZq2o9W7GsxBbPr:cGCq2iW7zpaGCq2iW7z
TLSH
T11DE2BFF28FC098FFC4CD353350863687CB7B8570DABA75BF82618867289AE05EC65495
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor discovery execution bdaejec

Malware Config

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral2/memory/5108-10-0x0000000000F90000-0x0000000000F99000-memory.dmp	family_bdaejec_backdoor

Detects executables packed with ASPack 5 IoCs

resource	yara_rule
behavioral2/memory/6084-0-0x0000000000B70000-0x0000000000B7E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d000000019cd9-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5108-5-0x0000000000F90000-0x0000000000F99000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6084-9-0x0000000000B70000-0x0000000000B7E000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5108-10-0x0000000000F90000-0x0000000000F99000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d000000019cd9-4.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5108	JukxnE.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Windows Defender\MpDefenderCoreService.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	JukxnE.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	JukxnE.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Windows Defender\MpDefenderCoreService.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	JukxnE.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	JukxnE.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	JukxnE.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	JukxnE.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	JukxnE.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	JukxnE.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	JukxnE.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	JukxnE.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	JukxnE.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	JukxnE.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	JukxnE.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	JukxnE.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe	JukxnE.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	JukxnE.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1224	cmd.exe
2604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JukxnE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 5108	6084	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe	87
PID 5108 wrote to memory of 1224	5108	JukxnE.exe	90
PID 6084 wrote to memory of 2604	6084	2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_3780a5c4393d08438309a053f55e755d_elex_smoke-loader_wapomi.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Users\Admin\AppData\Local\Temp\JukxnE.exe
  C:\Users\Admin\AppData\Local\Temp\JukxnE.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\40711aff.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\363f32ed.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 31KB
SHA256 a20746e77028a9a5d4bc491db24b762b0326983dc89a3064186a0ecf2a37b5b9
MD5 353d380e541801ce750ef574b8e3a22e
SHA1 e2270cd25b61fff69ff0c25d9f1200b60c3371b5
SHA512 e4ec19212e0cc891e530f43320cf8f56d949287e3d2397b22ca728147d1410278aece2f11c93aa07b15906bbba181b00d12022e01c98b7b320b064e9739dfa11
SSDEEP 768:6WQ3655Kv1KjqY1MNHmuQGPL4vzZq2o9W7GsxBbPr:6HqaN6qHmVGCq2iW7z
TLSH
T12DE28D53CF9054F6E7EF253160FA3A478AB7AD2089A4EE5F83707A9D1C34600E862257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

363f32ed.bat

Path C:\Users\Admin\AppData\Local\Temp\363f32ed.bat
Size 311B
SHA256 2afd69eddb932092af8eb03391ed5609ff3f1f0a4169d0026ea52f249b82782c
MD5 9894a5c2b0a84f7824e0eb6992529286
SHA1 dd7c9941d89aa2b97ca1bf71819907758ba79298
SHA512 0785508b5966720924daec2152e1553fbb6ef8fc323ef3959ee5318212b73c6c42b0f57f7b842254747a922e86f098721bdd995938c3c7392d0e957c06d3f386
TLSH
T11EE0CDD78177CD17181495136B90298CC3A43F982F49B7226730C95D95C504CEEA2342
MD5 SHA1 SHA512 TLSH

Submit Download

40711aff.bat

Path C:\Users\Admin\AppData\Local\Temp\40711aff.bat
Size 187B
SHA256 fb4fc683f20d3502b04a07ecdc57666c0ca3a3dc161ede0fc2810237e8b373d2
MD5 4ac81a487991e9699d3e9d97a069cdbe
SHA1 3c1d87b2fda462c9a25258b2d437a6d4aa33bd7b
SHA512 69891df7a95d75382b1aaebd241b8c57fe93bf33d261363b6096684ec9ff3a44511e927f12b650915ef287f0e8b0c7ba9cbabccc0fc12eee7c8d8f4545298260
TLSH
T1BBC012018287C699245550174AE1714CC0790D687B5A6F124B20C4EDA1ABC0DF5C3302
MD5 SHA1 SHA512 TLSH

Submit Download

JukxnE.exe

Path C:\Users\Admin\AppData\Local\Temp\JukxnE.exe
Size 15KB
SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
MD5 56b2c3810dba2e939a8bb9fa36d3cf96
SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
TLSH
T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5108-5-0x0000000000F90000-0x0000000000F99000-memory.dmp

Download

memory/5108-10-0x0000000000F90000-0x0000000000F99000-memory.dmp

Download

memory/6084-0-0x0000000000B70000-0x0000000000B7E000-memory.dmp

Download

memory/6084-9-0x0000000000B70000-0x0000000000B7E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads