Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
-
submitted
29-06-2023 16:13
General
-
Target
BABYLONexe.exe
-
Size
355KB
-
MD5
072428ed08c736d6f81aea71741389b8
-
SHA1
6efa1a089267ce56b1962f2f93e5564256d38a1e
-
SHA256
e8eefab37fec532a017d60a2851ed8aff3f4589028e9ca6794d100ea758bddb1
-
SHA512
f53ba351383eaa4f375b89032f974215b808b0e50591a430e552e29d43a327da4ed028d5cd01e4a1d7b332b6fcfd21cc6609d54cd88a5ce4909df0c7cd393c15
-
SSDEEP
6144:9L1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19N:9LdcfxaeM6fy/KaVUtgKkTZ73coNRJN
Score
10/10
Malware Config
Extracted
Family
babylonrat
C2
179.43.162.58
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BABYLONexe.exe"C:\Users\Admin\AppData\Local\Temp\BABYLONexe.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB