Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/11/2026, 08:41
Behavioral task
behavioral1
Sample
010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe
- Size 2.4MB
- Sample261108-klmpvsbw4m
- SHA256 010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c
- MD5 3741f6ad95545b3e894472dc4af95800
- SHA1 968dadd43ea5f25f5649e10aee19b97588812139
- SHA512 ae4bcf2c396f33d4a7b07686c6075e8115637229d933b3049480fa35a3dc217f2962eb3531a2ae708a65a4996952872540644ba6b08fc536fce3d03049e60e14
- SSDEEP 49152:9shdsYv1Knq/4ilVMukPNDuMmh7/vGpCwgk7zEXIHjM6Xxsdz7Cdrq5qtk2/Mxpk:U1KnO4ilV1kNfI+Jgk7IXIHQ6XxuzWds
- TLSH T1E4C533D4B012251FCFDA03B9011A94767FA58E3BE03119C5CA74FF12BCBAE879A95E05
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Signatures
- Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/5448-10-0x0000000000010000-0x0000000000019000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x0007000000016b55-4.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5448 gIeL.exe - AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4984-8-0x0000000000350000-0x0000000000843000-memory.dmp autoit_exe -
resource yara_rule behavioral2/memory/4984-0-0x0000000000350000-0x0000000000843000-memory.dmp upx behavioral2/memory/4984-8-0x0000000000350000-0x0000000000843000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE gIeL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE gIeL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe gIeL.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe gIeL.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE gIeL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe gIeL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE gIeL.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe gIeL.exe File opened for modification C:\Program Files\dotnet\dotnet.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe gIeL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe gIeL.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE gIeL.exe File opened for modification C:\Program Files\Windows Defender\MpDefenderCoreService.exe gIeL.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe gIeL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE gIeL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe gIeL.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe gIeL.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE gIeL.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe gIeL.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe gIeL.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe gIeL.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe gIeL.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe gIeL.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe gIeL.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe gIeL.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3152 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname gIeL.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain gIeL.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gIeL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4984 010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4984 wrote to memory of 5448 4984 010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe 89 PID 5448 wrote to memory of 3152 5448 gIeL.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe"C:\Users\Admin\AppData\Local\Temp\010805655e302fc82bded2efaaec6b2bc4e30af7595ae63250bad75606271a7c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\gIeL.exeC:\Users\Admin\AppData\Local\Temp\gIeL.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5448 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\07d01702.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3152
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\07d01702.bat
- Size 183B
- SHA256 11dc3f002e82c152ff06288431ba0f4714d9159367e202d484c129e372e4fc69
- MD5 416295e5c9b3ad112a788016a10c8905
- SHA1 c27082362ea314919bfbf7b48d6731f526414656
- SHA512 3c158ed249949083ff58a11324b0dc4ea6278ed52926d58652d700c8e1fe0377a7ceb1450b898716f469c77856097fd4b5f9f56dd7f6f7b681b6244fc8a50ed8
- TLSH T158C01212828FD6591855901706E5618CC07509683F9A2B264B20C85C619650DF5C7341
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\gIeL.exe
- Size 15KB
- SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
- MD5 f7d21de5c4e81341eccd280c11ddcc9a
- SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
- SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3
- SSDEEP 384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
- TLSH T1A462BFB34FC098FFC4CD353341853687CB7B4670DABA617F826288372895E19AC55495
- MD5 SHA1 SHA512 SSDEEP TLSH