Analysis
-
max time kernel
150s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
06-07-2023 21:04
General
-
Target
DriverDiagnoseTool.exe
-
Size
300.9MB
-
MD5
d70de5a533c758bcba7ff16d204cdbe6
-
SHA1
38d9f39f8c3699c04c4e4ba3e33afbed745e3e8f
-
SHA256
40d348783300d039d969f27a22433a8cba8d31c28e2e8d542c10a5792d34c1d3
-
SHA512
a9355532ad9310a61f1b07926a64d48669ebf3e15e45c18a28a7b16c3e94d66037752d45b36e26c2dbb247b2d9fdcedc18f00fb4229daece372f44af418c07f1
-
SSDEEP
6291456:vz2C0PyE4M6Q1nYOCNxklwFy3kMj/2Lk6T8yV3hVJC45EHbzwIgjx:KC0PyE4M6Q1bMxTFy3r7d6T8y72HZk
Score
10/10
Malware Config
Extracted
Family
babylonrat
C2
149.28.19.207
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DriverDiagnoseTool.exe"C:\Users\Admin\AppData\Local\Temp\DriverDiagnoseTool.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
228KB
-
Filesize
228KB