babadeda | 2c7b9551db37471000c475793cd8cd5521f0f27aa84eca5028c3fed7134e3ce3

Analysis

max time kernel
146s
max time network
145s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14-11-2022 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe
Size

5.7MB
MD5

ddd5bb53200e40fc5b34fd7e6448e815
SHA1

0e55418801977101a01d86661b91708dcbeb77a3
SHA256

642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5
SHA512

69251a229641307125d41cb15533384b2bea21713d4b78312bba0a9fdcf772fd238ba78f8f99a4f8a4aa031e0177a6319d740213d6176b2f829ca0bd865da823
SSDEEP

98304:8SioTgQu/5J0Mx7VoRqoR6QC75qAujjDPAj+fq4v3snPcMp:s/v0OVoRhR6Z74A0jrAj+yYAcK

Score

10^/10

babadeda fickerstealer crypter infostealer loader

Malware Config

Extracted

Family

fickerstealer

185.163.45.132:80

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000122f9-79.dat	family_babadeda

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Executes dropped EXE 3 IoCs

pid	Process
1264	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp
452	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp
664	adminsentry.exe

Loads dropped DLL 5 IoCs

pid	Process
1632	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe
1972	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe
452	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp
452	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp
664	adminsentry.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
452	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp
452	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
452	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1264	1632	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	28
PID 1632 wrote to memory of 1264	1632	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	28
PID 1632 wrote to memory of 1264	1632	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	28
PID 1632 wrote to memory of 1264	1632	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	28
PID 1632 wrote to memory of 1264	1632	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	28
PID 1632 wrote to memory of 1264	1632	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	28
PID 1632 wrote to memory of 1264	1632	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	28
PID 1264 wrote to memory of 1972	1264	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp	29
PID 1264 wrote to memory of 1972	1264	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp	29
PID 1264 wrote to memory of 1972	1264	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp	29
PID 1264 wrote to memory of 1972	1264	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp	29
PID 1264 wrote to memory of 1972	1264	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp	29
PID 1264 wrote to memory of 1972	1264	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp	29
PID 1264 wrote to memory of 1972	1264	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp	29
PID 1972 wrote to memory of 452	1972	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	30
PID 1972 wrote to memory of 452	1972	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	30
PID 1972 wrote to memory of 452	1972	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	30
PID 1972 wrote to memory of 452	1972	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	30
PID 1972 wrote to memory of 452	1972	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	30
PID 1972 wrote to memory of 452	1972	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	30
PID 1972 wrote to memory of 452	1972	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe	30
PID 452 wrote to memory of 664	452	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp	31
PID 452 wrote to memory of 664	452	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp	31
PID 452 wrote to memory of 664	452	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp	31
PID 452 wrote to memory of 664	452	642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp	31

C:\Users\Admin\AppData\Local\Temp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe
"C:\Users\Admin\AppData\Local\Temp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\is-0Q3E6.tmp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0Q3E6.tmp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp" /SL5="$70120,5153887,831488,C:\Users\Admin\AppData\Local\Temp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Users\Admin\AppData\Local\Temp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe
    "C:\Users\Admin\AppData\Local\Temp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe" /VERYSILENT
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\is-65LGK.tmp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-65LGK.tmp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp" /SL5="$7011C,5153887,831488,C:\Users\Admin\AppData\Local\Temp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:452
    - - C:\Users\Admin\AppData\Roaming\Direct Search\adminsentry.exe
        
        "C:\Users\Admin\AppData\Roaming\Direct Search\adminsentry.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-0Q3E6.tmp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp

Filesize
3.0MB

MD5
0b5f6afebd00a69abd16c9f663b4ae11

SHA1
1539cafe14971109dda8c1fb5fab81770e649e2e

SHA256
2acf8c741447feae0cefa3be0e83b06af6f2e6ef8d7a16c6712b3bf029ec8433

SHA512
50196bdbc3b860f1340b6177f14bb2ef8a310f29cffd25a044f9f63096fcbfea908cedc31246a4505b648a5fdb112c10827bf35cf1181a9bde7fe3c311471d91

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-65LGK.tmp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp

Filesize
3.0MB

MD5
0b5f6afebd00a69abd16c9f663b4ae11

SHA1
1539cafe14971109dda8c1fb5fab81770e649e2e

SHA256
2acf8c741447feae0cefa3be0e83b06af6f2e6ef8d7a16c6712b3bf029ec8433

SHA512
50196bdbc3b860f1340b6177f14bb2ef8a310f29cffd25a044f9f63096fcbfea908cedc31246a4505b648a5fdb112c10827bf35cf1181a9bde7fe3c311471d91

Download Submit
C:\Users\Admin\AppData\Roaming\Direct Search\adminsentry.exe

Filesize
4.9MB

MD5
298a9a9ed40fb6ca3bdeebcce0264f40

SHA1
c04728f7b70a1ac89754ad93470cee19943f0bdd

SHA256
055859fa37ea4b1344c575b02975bac8b87adc667e3674aaa010d6c5ad4a840a

SHA512
26aeb9c9ecace8dba902a687a06ef925d22a66e86e96a5dc750ea576228932a58419afbb0c561c0bbcbd965c7dc18e1eeda892ea0a5f1a24bc4dbc09c923b66c

Download Submit
C:\Users\Admin\AppData\Roaming\Direct Search\libvorbisenc-2.dll

Filesize
2.8MB

MD5
4b818c47ec6801a6bb166a317af2c96e

SHA1
e1b21af50829d4b937d16f9406381c183c2a7faf

SHA256
585fa2834094efea7ed8fe2c9597394f1fdd3cae75e1f8cc1a8ce9bf3206b62f

SHA512
1aecb53c24f802615fc375e75d484d220ce81b32c8a48aaa992440b44e3486adb74e40967988cf934a2579809dd0099e5384e38a79beae4ca751cfb7b110e90d

Download Submit
C:\Users\Admin\AppData\Roaming\Direct Search\menu.xml

Filesize
863KB

MD5
fb538dc26cbcc346b34059f360373f1a

SHA1
5058bd28c88abb61f7d734477f809d6d6cee8afb

SHA256
14059b988a302a0b180c73c6707ea63f85fdee827b1fa35330467a2974a0ab63

SHA512
f31420098ce181d1c6debe9cfd098fd0a9485230bcc5e970b0b70368afa9c9850a32f5cecc0b8da44673d658b033c9ae043b430a04ab1fb96c2fa2d93b4e87cb

Download Submit
\Users\Admin\AppData\Local\Temp\is-0Q3E6.tmp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp

Filesize
3.0MB

MD5
0b5f6afebd00a69abd16c9f663b4ae11

SHA1
1539cafe14971109dda8c1fb5fab81770e649e2e

SHA256
2acf8c741447feae0cefa3be0e83b06af6f2e6ef8d7a16c6712b3bf029ec8433

SHA512
50196bdbc3b860f1340b6177f14bb2ef8a310f29cffd25a044f9f63096fcbfea908cedc31246a4505b648a5fdb112c10827bf35cf1181a9bde7fe3c311471d91

Download Submit
\Users\Admin\AppData\Local\Temp\is-65LGK.tmp\642c7333927b2581ffc854f55793677a203788fb55a53e8916ae58d4cd0828f5.tmp

Filesize
3.0MB

MD5
0b5f6afebd00a69abd16c9f663b4ae11

SHA1
1539cafe14971109dda8c1fb5fab81770e649e2e

SHA256
2acf8c741447feae0cefa3be0e83b06af6f2e6ef8d7a16c6712b3bf029ec8433

SHA512
50196bdbc3b860f1340b6177f14bb2ef8a310f29cffd25a044f9f63096fcbfea908cedc31246a4505b648a5fdb112c10827bf35cf1181a9bde7fe3c311471d91

Download Submit
\Users\Admin\AppData\Roaming\Direct Search\adminsentry.exe

Filesize
4.9MB

MD5
298a9a9ed40fb6ca3bdeebcce0264f40

SHA1
c04728f7b70a1ac89754ad93470cee19943f0bdd

SHA256
055859fa37ea4b1344c575b02975bac8b87adc667e3674aaa010d6c5ad4a840a

SHA512
26aeb9c9ecace8dba902a687a06ef925d22a66e86e96a5dc750ea576228932a58419afbb0c561c0bbcbd965c7dc18e1eeda892ea0a5f1a24bc4dbc09c923b66c

Download Submit
\Users\Admin\AppData\Roaming\Direct Search\adminsentry.exe

Filesize
4.9MB

MD5
298a9a9ed40fb6ca3bdeebcce0264f40

SHA1
c04728f7b70a1ac89754ad93470cee19943f0bdd

SHA256
055859fa37ea4b1344c575b02975bac8b87adc667e3674aaa010d6c5ad4a840a

SHA512
26aeb9c9ecace8dba902a687a06ef925d22a66e86e96a5dc750ea576228932a58419afbb0c561c0bbcbd965c7dc18e1eeda892ea0a5f1a24bc4dbc09c923b66c

Download Submit
\Users\Admin\AppData\Roaming\Direct Search\libvorbisenc-2.dll

Filesize
2.8MB

MD5
4b818c47ec6801a6bb166a317af2c96e

SHA1
e1b21af50829d4b937d16f9406381c183c2a7faf

SHA256
585fa2834094efea7ed8fe2c9597394f1fdd3cae75e1f8cc1a8ce9bf3206b62f

SHA512
1aecb53c24f802615fc375e75d484d220ce81b32c8a48aaa992440b44e3486adb74e40967988cf934a2579809dd0099e5384e38a79beae4ca751cfb7b110e90d

Download Submit
memory/452-72-0x0000000074F21000-0x0000000074F23000-memory.dmp

Filesize
8KB

Download
memory/452-81-0x00000000038F0000-0x0000000003DD8000-memory.dmp

Filesize
4.9MB

Download
memory/452-67-0x0000000000000000-mapping.dmp

Download
memory/452-80-0x0000000003370000-0x0000000003380000-memory.dmp

Filesize
64KB

Download
memory/664-82-0x0000000000400000-0x00000000008E8000-memory.dmp

Filesize
4.9MB

Download
memory/664-85-0x0000000000400000-0x00000000008E8000-memory.dmp

Filesize
4.9MB

Download
memory/664-75-0x0000000000000000-mapping.dmp

Download
memory/1264-59-0x0000000000000000-mapping.dmp

Download
memory/1632-70-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1632-57-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1632-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1632-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1972-62-0x0000000000000000-mapping.dmp

Download
memory/1972-71-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1972-83-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1972-64-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download