Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/11/2026, 08:41
Behavioral task
behavioral1
Sample
010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe
- Size 2.4MB
- Sample261108-klmpvsbw4m
- SHA256 010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c
- MD5 3741f6ad95545b3e894472dc4af95800
- SHA1 968dadd43ea5f25f5649e10aee19b97588812139
- SHA512 ae4bcf2c396f33d4a7b07686c6075e8115637229d933b3049480fa35a3dc217f2962eb3531a2ae708a65a4996952872540644ba6b08fc536fce3d03049e60e14
- SSDEEP 49152:9shdsYv1Knq/4ilVMukPNDuMmh7/vGpCwgk7zEXIHjM6Xxsdz7Cdrq5qtk2/Mxpk:U1KnO4ilV1kNfI+Jgk7IXIHQ6XxuzWds
- TLSH T1E4C533D4B012251FCFDA03B9011A94767FA58E3BE03119C5CA74FF12BCBAE879A95E05
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Signatures
- Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/4268-9-0x0000000000CB0000-0x0000000000CB9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral1/files/0x000a00000002433c-3.dat aspack_v212_v242 - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation gIeL.exe - Executes dropped EXE 1 IoCs
pid Process 4268 gIeL.exe - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1132-7-0x0000000000700000-0x0000000000BF3000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/1132-1-0x0000000000700000-0x0000000000BF3000-memory.dmp upx behavioral1/memory/1132-7-0x0000000000700000-0x0000000000BF3000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe gIeL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe gIeL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe gIeL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE gIeL.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE gIeL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe gIeL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe gIeL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE gIeL.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe gIeL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE gIeL.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE gIeL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe gIeL.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe gIeL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe gIeL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe gIeL.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe gIeL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe gIeL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe gIeL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe gIeL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe gIeL.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE gIeL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe gIeL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe gIeL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe gIeL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE gIeL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe gIeL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE gIeL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe gIeL.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe gIeL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5064 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain gIeL.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname gIeL.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gIeL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1132 010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1132 wrote to memory of 4268 1132 010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe 85 PID 4268 wrote to memory of 5064 4268 gIeL.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe"C:\Users\Admin\AppData\Local\Temp\010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\gIeL.exeC:\Users\Admin\AppData\Local\Temp\gIeL.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4f9303f4.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:5064
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\4f9303f4.bat
- Size 183B
- SHA256 2c9d12d06b61a8486c8ece79da2b7d9e9c8d48f5df8c2abe3a255e2dbd2387ea
- MD5 e695e6b79a386b655e0d8ac10273b764
- SHA1 ffe29380030957b0869df23da3f96e43089f2dce
- SHA512 aac196895a3a08fa8a3718c4b7ede2a9868f1044067815242ff6ecfce8d960432f12fb1341a4503bd3f0a2ebc181319171d9b962e2fd1936d48c9b6f1755542b
- TLSH T1CFC01221828FD66A1854A02B0AE2718CC0B509A83B8A2B224B22C85C61A691DBAD3341
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\gIeL.exe
- Size 15KB
- SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
- MD5 f7d21de5c4e81341eccd280c11ddcc9a
- SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
- SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3
- SSDEEP 384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
- TLSH T1A462BFB34FC098FFC4CD353341853687CB7B4670DABA617F826288372895E19AC55495
- MD5 SHA1 SHA512 SSDEEP TLSH