babadeda | c4c4907ba3a60d331c7bfa836babe276a4166a889ca734a3f40916ace8a80f9d

Analysis

max time kernel
151s
max time network
159s
platform
windows7_x64
resource
win7-en-20211208
submitted
18-02-2022 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RariCapital-Market-App-v2.1.1.exe
Size

119.7MB
MD5

66cf17cef0fa02c78363850fa888017b
SHA1

255735f0107fd4c101e7f53820f78d0889cd4bc4
SHA256

c4c4907ba3a60d331c7bfa836babe276a4166a889ca734a3f40916ace8a80f9d
SHA512

f14e074aad2a5c7db1e5256f73cad0c27199eb3eb60c2f9040336996717fa7c6456015c1995a04f61fb436b192eb86580b452acb7cf18d5c1520afc46305bd15

Score

10^/10

babadeda remcos sys32 crypter loader persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Sys32

157.90.1.54:4783

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Logs
keylog_path
%AppData%
mouse_option
false
mutex
Sys-CZ7MI0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 2 IoCs

resource	yara_rule
behavioral1/files/0x0004000000019c40-126.dat	family_babadeda
behavioral1/memory/1832-127-0x0000000004780000-0x0000000008980000-memory.dmp	family_babadeda

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 4 IoCs

pid	Process
1736	RariCapital-Market-App-v2.1.1.tmp
876	RariCapital-Market-App-v2.1.1.tmp
632	nmake.exe
1832	PDapp.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apmanager.lnk	PDapp.exe

Loads dropped DLL 31 IoCs

pid	Process
1192	RariCapital-Market-App-v2.1.1.exe
816	RariCapital-Market-App-v2.1.1.exe
876	RariCapital-Market-App-v2.1.1.tmp
632	nmake.exe
876	RariCapital-Market-App-v2.1.1.tmp
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe
1832	PDapp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\App Platform Manager = "C:\\Users\\Admin\\AppData\\Local\\Markdown Monster\\PDapp.exe"	PDapp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
876	RariCapital-Market-App-v2.1.1.tmp
876	RariCapital-Market-App-v2.1.1.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1832	PDapp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
876	RariCapital-Market-App-v2.1.1.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1832	PDapp.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1736	1192	RariCapital-Market-App-v2.1.1.exe	27
PID 1192 wrote to memory of 1736	1192	RariCapital-Market-App-v2.1.1.exe	27
PID 1192 wrote to memory of 1736	1192	RariCapital-Market-App-v2.1.1.exe	27
PID 1192 wrote to memory of 1736	1192	RariCapital-Market-App-v2.1.1.exe	27
PID 1192 wrote to memory of 1736	1192	RariCapital-Market-App-v2.1.1.exe	27
PID 1192 wrote to memory of 1736	1192	RariCapital-Market-App-v2.1.1.exe	27
PID 1192 wrote to memory of 1736	1192	RariCapital-Market-App-v2.1.1.exe	27
PID 1736 wrote to memory of 816	1736	RariCapital-Market-App-v2.1.1.tmp	28
PID 1736 wrote to memory of 816	1736	RariCapital-Market-App-v2.1.1.tmp	28
PID 1736 wrote to memory of 816	1736	RariCapital-Market-App-v2.1.1.tmp	28
PID 1736 wrote to memory of 816	1736	RariCapital-Market-App-v2.1.1.tmp	28
PID 1736 wrote to memory of 816	1736	RariCapital-Market-App-v2.1.1.tmp	28
PID 1736 wrote to memory of 816	1736	RariCapital-Market-App-v2.1.1.tmp	28
PID 1736 wrote to memory of 816	1736	RariCapital-Market-App-v2.1.1.tmp	28
PID 816 wrote to memory of 876	816	RariCapital-Market-App-v2.1.1.exe	29
PID 816 wrote to memory of 876	816	RariCapital-Market-App-v2.1.1.exe	29
PID 816 wrote to memory of 876	816	RariCapital-Market-App-v2.1.1.exe	29
PID 816 wrote to memory of 876	816	RariCapital-Market-App-v2.1.1.exe	29
PID 816 wrote to memory of 876	816	RariCapital-Market-App-v2.1.1.exe	29
PID 816 wrote to memory of 876	816	RariCapital-Market-App-v2.1.1.exe	29
PID 816 wrote to memory of 876	816	RariCapital-Market-App-v2.1.1.exe	29
PID 876 wrote to memory of 632	876	RariCapital-Market-App-v2.1.1.tmp	30
PID 876 wrote to memory of 632	876	RariCapital-Market-App-v2.1.1.tmp	30
PID 876 wrote to memory of 632	876	RariCapital-Market-App-v2.1.1.tmp	30
PID 876 wrote to memory of 632	876	RariCapital-Market-App-v2.1.1.tmp	30
PID 876 wrote to memory of 1832	876	RariCapital-Market-App-v2.1.1.tmp	32
PID 876 wrote to memory of 1832	876	RariCapital-Market-App-v2.1.1.tmp	32
PID 876 wrote to memory of 1832	876	RariCapital-Market-App-v2.1.1.tmp	32
PID 876 wrote to memory of 1832	876	RariCapital-Market-App-v2.1.1.tmp	32

C:\Users\Admin\AppData\Local\Temp\RariCapital-Market-App-v2.1.1.exe
"C:\Users\Admin\AppData\Local\Temp\RariCapital-Market-App-v2.1.1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\is-BPIPM.tmp\RariCapital-Market-App-v2.1.1.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BPIPM.tmp\RariCapital-Market-App-v2.1.1.tmp" /SL5="$C014E,124691941,893952,C:\Users\Admin\AppData\Local\Temp\RariCapital-Market-App-v2.1.1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Users\Admin\AppData\Local\Temp\RariCapital-Market-App-v2.1.1.exe
    "C:\Users\Admin\AppData\Local\Temp\RariCapital-Market-App-v2.1.1.exe" /VERYSILENT
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Users\Admin\AppData\Local\Temp\is-HQTU6.tmp\RariCapital-Market-App-v2.1.1.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-HQTU6.tmp\RariCapital-Market-App-v2.1.1.tmp" /SL5="$D014E,124691941,893952,C:\Users\Admin\AppData\Local\Temp\RariCapital-Market-App-v2.1.1.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:876
    - - C:\Users\Admin\AppData\Local\Markdown Monster\nmake.exe
        
        "C:\Users\Admin\AppData\Local\Markdown Monster\nmake.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:632
    - - C:\Users\Admin\AppData\Local\Markdown Monster\PDapp.exe
        
        "C:\Users\Admin\AppData\Local\Markdown Monster\PDapp.exe"
        5⤵
        Executes dropped EXE
        Drops startup file
        Loads dropped DLL
        Adds Run key to start application
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:1832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-64-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/876-69-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/876-70-0x00000000745F1000-0x00000000745F3000-memory.dmp

Filesize
8KB

Download
memory/1192-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1192-60-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download
memory/1192-56-0x0000000000400000-0x00000000004E8000-memory.dmp

Filesize
928KB

Download
memory/1736-62-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1832-127-0x0000000004780000-0x0000000008980000-memory.dmp

Filesize
66.0MB

Download
memory/1832-128-0x00000000031B0000-0x000000000322A000-memory.dmp

Filesize
488KB

Download