Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/11/2026, 16:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-02_0ad326953e527c1c98f1e3083000b24e_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-11-02_0ad326953e527c1c98f1e3083000b24e_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi.exe
- Size 112KB
- Sample261103-th1a8aax8s
- SHA256 b67607b00b29658e3bf068c4bcee057ce49aa6cc4e30701510a2d74a074284d9
- MD5 0ad326953e527c1c98f1e3083000b24e
- SHA1 29301f76be685ddc466f6bad093673b612deb9aa
- SHA512 f928fdd2a5070029ad14e23de4280cd26f2b5520d275c3162da6c79343561822e01f25d2a1e4766e5b7621a980262d13bd02e549bf302846a9585c154e9d6a80
- SSDEEP 1536:aogtezQFW6GRGiJoOuqSyEQax/wGJKq1Kd0hT7LbMLitTIzU92FfHYTo7VAGCq2d:aobLh1JFWQaP1pT7kc39wfHYTo7KGCH
- TLSH T1B3B39E217390D0BAF45624305D2AC3724A7EBC3146B9898B73D47B3E1E713C1AA7AB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Signatures
- Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/4264-9-0x00000000006D0000-0x00000000006D9000-memory.dmp family_bdaejec_backdoor - Custom signatureDetects executables packed with ASPack 3 IoCs
resource yara_rule behavioral2/files/0x000a00000001b2c5-4.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4264-5-0x00000000006D0000-0x00000000006D9000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4264-9-0x00000000006D0000-0x00000000006D9000-memory.dmp INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000a00000001b2c5-4.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4264 wYaOtM.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE wYaOtM.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE wYaOtM.exe File opened for modification C:\Program Files\7-Zip\7z.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe wYaOtM.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe wYaOtM.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe wYaOtM.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe wYaOtM.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe wYaOtM.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe wYaOtM.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe wYaOtM.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe wYaOtM.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe wYaOtM.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE wYaOtM.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE wYaOtM.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe wYaOtM.exe File opened for modification C:\Program Files\Windows Mail\wab.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE wYaOtM.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe wYaOtM.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE wYaOtM.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe wYaOtM.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe wYaOtM.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4544 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wYaOtM.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wYaOtM.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-02_0ad326953e527c1c98f1e3083000b24e_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wYaOtM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1072 wrote to memory of 4264 1072 2026-11-02_0ad326953e527c1c98f1e3083000b24e_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi.exe 89 PID 4264 wrote to memory of 4544 4264 wYaOtM.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-02_0ad326953e527c1c98f1e3083000b24e_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-02_0ad326953e527c1c98f1e3083000b24e_elex_karagany_rhadamanthys_smoke-loader_stealc_wapomi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\wYaOtM.exeC:\Users\Admin\AppData\Local\Temp\wYaOtM.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\520d0ffc.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4544
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\520d0ffc.bat
- Size 187B
- SHA256 85e74f9c4a0ee12315a16ebe66d3eaba6d521814002bb95e034728e89c46498d
- MD5 ddbcd7f0b980c717d7262728fd91a046
- SHA1 d5ceff0f3c7f8857466fadc0edd4fc4724e836d9
- SHA512 7560bd94e36fb6325caaaead93af9fd819145a40ea5b6d318a0647be9ad120a18111974953e9c8c8fd24b73eba87474661e90694bb5b0196b1e718921ae76e14
- TLSH T128C012428197C65D1554601747E961CCC075085C3BA93B315F20C46C61DA40DB5D7312
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wYaOtM.exe
- Size 15KB
- SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
- MD5 56b2c3810dba2e939a8bb9fa36d3cf96
- SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
- SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
- SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
- TLSH T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
- MD5 SHA1 SHA512 SSDEEP TLSH