babadeda | 99e6b46a1eba6fd60b9568622a2a27b4ae1ac02e55ab8b13709f38455345aaff

General

Target

99e6b46a1eba6fd60b9568622a2a27b4ae1ac02e55ab8b13709f38455345aaff.exe
Size

11.7MB
MD5

0013ee610f83b401007adbefef051305
SHA1

f322e18219aa1abd91640b4d2b47fc1992068d16
SHA256

99e6b46a1eba6fd60b9568622a2a27b4ae1ac02e55ab8b13709f38455345aaff
SHA512

27abdf3bd117cd85e18d633ddcb35586791cc7f41caf9797fdbdc726befd140c8dbd2a3a3a032581f1f20e226b6f29327a6f9892255ab6b69c27d1e13719fe5b
SSDEEP

196608:f6/ssSAAdFmYR0BwJ6DOlmreNUbR8cTGVqdZtzQ4cXwokT0YETuhtNo2vwDYpmv+:f69sFmYR0CJ6UmCNUbR8uGotzSXjkMud

Score

10^/10

babadeda bitrat crypter loader trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

C2

145.239.202.9:4598

Attributes

communication_password
2ff037574f878c384918323c55e52186
tor_process
tor

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

resource	yara_rule
behavioral2/files/0x0001000000023165-432.dat	family_babadeda

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	99e6b46a1eba6fd60b9568622a2a27b4ae1ac02e55ab8b13709f38455345aaff.exe

Executes dropped EXE 1 IoCs

pid	Process
1940	difserver.exe

Loads dropped DLL 1 IoCs

pid	Process
1940	difserver.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1188-133-0x0000000000400000-0x000000000072F000-memory.dmp	upx
behavioral2/memory/1188-433-0x0000000000400000-0x000000000072F000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1940	difserver.exe
1940	difserver.exe
1940	difserver.exe
1940	difserver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1940	difserver.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1940	difserver.exe
1940	difserver.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 1940	1188	99e6b46a1eba6fd60b9568622a2a27b4ae1ac02e55ab8b13709f38455345aaff.exe	82
PID 1188 wrote to memory of 1940	1188	99e6b46a1eba6fd60b9568622a2a27b4ae1ac02e55ab8b13709f38455345aaff.exe	82
PID 1188 wrote to memory of 1940	1188	99e6b46a1eba6fd60b9568622a2a27b4ae1ac02e55ab8b13709f38455345aaff.exe	82

C:\Users\Admin\AppData\Local\Temp\99e6b46a1eba6fd60b9568622a2a27b4ae1ac02e55ab8b13709f38455345aaff.exe
"C:\Users\Admin\AppData\Local\Temp\99e6b46a1eba6fd60b9568622a2a27b4ae1ac02e55ab8b13709f38455345aaff.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Roaming\Diffractor\Virtual Diffractor Server\difserver.exe
  "C:\Users\Admin\AppData\Roaming\Diffractor\Virtual Diffractor Server\difserver.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Diffractor\Virtual Diffractor Server\Lang\it\Phototheca EULA.rtf

Filesize
5KB

MD5
9325aee138a4d9a15d651920fb403ffc

SHA1
19eb57cd989571fa8cd426cbd680430c0e006408

SHA256
9c8346c7f288e63933ebda42cbb874f76067c48198b01adfb63bccfa11970c35

SHA512
d3c0ccf217346e44436ac4f9db3e71b6d2eb152930005f019db5b58dcce923d94007e77fa5b938e182073c2e55163e886853b00e3fc22f135d70854120a218a8

Download Submit
C:\Users\Admin\AppData\Roaming\Diffractor\Virtual Diffractor Server\difserver.exe

Filesize
6.2MB

MD5
ec538ff191a52b5ca9f67ae5d5d56908

SHA1
fb583f5953db1c0397859bb91afd5b0a5f6f366c

SHA256
358211210e0bb34dd77073bb0de64bb80723f3434594caf1a95d0ed164ee87a1

SHA512
ce80b6c4783459da9bead38dd204e5046b046098bf22f4d853a048ed89c20757c7992d4512d83163dcb8f94e0fb45a021b639f5e2323236fece49a7de8c4b787

Download Submit
C:\Users\Admin\AppData\Roaming\Diffractor\Virtual Diffractor Server\difserver.exe

Filesize
6.2MB

MD5
ec538ff191a52b5ca9f67ae5d5d56908

SHA1
fb583f5953db1c0397859bb91afd5b0a5f6f366c

SHA256
358211210e0bb34dd77073bb0de64bb80723f3434594caf1a95d0ed164ee87a1

SHA512
ce80b6c4783459da9bead38dd204e5046b046098bf22f4d853a048ed89c20757c7992d4512d83163dcb8f94e0fb45a021b639f5e2323236fece49a7de8c4b787

Download Submit
C:\Users\Admin\AppData\Roaming\Diffractor\Virtual Diffractor Server\difserver.exe

Filesize
6.2MB

MD5
ec538ff191a52b5ca9f67ae5d5d56908

SHA1
fb583f5953db1c0397859bb91afd5b0a5f6f366c

SHA256
358211210e0bb34dd77073bb0de64bb80723f3434594caf1a95d0ed164ee87a1

SHA512
ce80b6c4783459da9bead38dd204e5046b046098bf22f4d853a048ed89c20757c7992d4512d83163dcb8f94e0fb45a021b639f5e2323236fece49a7de8c4b787

Download Submit
C:\Users\Admin\AppData\Roaming\Diffractor\Virtual Diffractor Server\libfont-0.6.dll

Filesize
3.9MB

MD5
e653f13bf4b225f1c7dce0e6404fc52a

SHA1
6e2ba578d8c14967a5ff2abbcce67a0e732c43d9

SHA256
ce3758d494132e7bef7ea87bb8379bb9f4b0c82768d65881139e1ec1838f236c

SHA512
96ced8dae8fb070cbc0a476d1a0a50233cc47f56e3621603d06e89db8667f3a611037395be729e075b40406860b80cd0fc0eb22603706845a762e9b15ad75efd

Download Submit
C:\Users\Admin\AppData\Roaming\Diffractor\Virtual Diffractor Server\libfont-0.6.dll

Filesize
3.9MB

MD5
e653f13bf4b225f1c7dce0e6404fc52a

SHA1
6e2ba578d8c14967a5ff2abbcce67a0e732c43d9

SHA256
ce3758d494132e7bef7ea87bb8379bb9f4b0c82768d65881139e1ec1838f236c

SHA512
96ced8dae8fb070cbc0a476d1a0a50233cc47f56e3621603d06e89db8667f3a611037395be729e075b40406860b80cd0fc0eb22603706845a762e9b15ad75efd

Download Submit
C:\Users\Admin\AppData\Roaming\Diffractor\Virtual Diffractor Server\menu.xml

Filesize
7.7MB

MD5
bacfa288e5c0f18a8f2c94d208d7c760

SHA1
912bd515c26f794cc65fa066ac01216cc7d35893

SHA256
080340cb4ced8a16cad2131dc2ac89e1516d0ebe5507d91b3e8fb341bfcfe7d8

SHA512
329e88c703ede60b537a94cc4b64e890048552de05a4a26530a770ead698644d38c34ece53ee4027ecc994613465cba76d15a5c560d586b3579465bb2e17637a

Download Submit
memory/1188-133-0x0000000000400000-0x000000000072F000-memory.dmp

Filesize
3.2MB

Download
memory/1188-140-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/1188-433-0x0000000000400000-0x000000000072F000-memory.dmp

Filesize
3.2MB

Download
memory/1940-428-0x0000000000060000-0x00000000006A3000-memory.dmp

Filesize
6.3MB

Download
memory/1940-434-0x0000000000060000-0x00000000006A3000-memory.dmp

Filesize
6.3MB

Download
memory/1940-435-0x0000000074D00000-0x0000000074D39000-memory.dmp

Filesize
228KB

Download
memory/1940-436-0x00000000750A0000-0x00000000750D9000-memory.dmp

Filesize
228KB

Download
memory/1940-437-0x0000000000060000-0x00000000006A3000-memory.dmp

Filesize
6.3MB

Download
memory/1940-439-0x00000000750A0000-0x00000000750D9000-memory.dmp

Filesize
228KB

Download
memory/1940-440-0x0000000000060000-0x00000000006A3000-memory.dmp

Filesize
6.3MB

Download

Resubmissions

Analysis

Sharing