babylonrat | ea8c4a6d9e6d8e9c9ed430f8a29760264dd7e4a438189a66d47c319b6c180981

General

Target

KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.ps1
Size

665B
MD5

6fb15b95d7c72e3ccbc83b37a41b45d4
SHA1

c5d8e777be55d08aeff6e3ab40b7768e446b5801
SHA256

36e08d17fb61edfd642fa968a62dcdd23c20952d9ac4550bb8e36ec908aff38b
SHA512

7f2072d027012ce27145787f3a2948f6f95bfccf0527ee444cd328243b0e18004bffe798320810ede91a02d38e0863a97248e376b15a75a6c763494fb06826c6

Score

10^/10

babylonrat persistence trojan upx

Malware Config

Extracted

Family

babylonrat

C2

149.28.19.207

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

Executes dropped EXE 1 IoCs

pid	Process
2260	DriverDiagnoseTool.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral7/memory/3024-64-0x0000000000230000-0x00000000002FA000-memory.dmp	upx
behavioral7/memory/3024-65-0x0000000000230000-0x00000000002FA000-memory.dmp	upx
behavioral7/memory/3024-74-0x0000000000230000-0x00000000002FA000-memory.dmp	upx
behavioral7/memory/2260-73-0x00000000004A0000-0x000000000056A000-memory.dmp	upx
behavioral7/memory/3024-72-0x0000000000230000-0x00000000002FA000-memory.dmp	upx
behavioral7/memory/3024-77-0x0000000000230000-0x00000000002FA000-memory.dmp	upx
behavioral7/memory/2260-76-0x00000000004A0000-0x000000000056A000-memory.dmp	upx
behavioral7/memory/3024-78-0x0000000000230000-0x00000000002FA000-memory.dmp	upx
behavioral7/memory/3024-80-0x0000000000230000-0x00000000002FA000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverDiagnoseTool = "C:\\Users\\Admin\\AppData\\Roaming\\DriverDiagnoseTool.exe"	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2960	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3024	DriverDiagnoseTool.exe
2992	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeShutdownPrivilege	3024	DriverDiagnoseTool.exe
Token: SeDebugPrivilege	3024	DriverDiagnoseTool.exe
Token: SeTcbPrivilege	3024	DriverDiagnoseTool.exe
Token: SeShutdownPrivilege	2260	DriverDiagnoseTool.exe
Token: SeDebugPrivilege	2260	DriverDiagnoseTool.exe
Token: SeTcbPrivilege	2260	DriverDiagnoseTool.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3024	DriverDiagnoseTool.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe
2992	AcroRd32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2992	2960	powershell.exe	28
PID 2960 wrote to memory of 2992	2960	powershell.exe	28
PID 2960 wrote to memory of 2992	2960	powershell.exe	28
PID 2960 wrote to memory of 2992	2960	powershell.exe	28
PID 2960 wrote to memory of 3024	2960	powershell.exe	29
PID 2960 wrote to memory of 3024	2960	powershell.exe	29
PID 2960 wrote to memory of 3024	2960	powershell.exe	29
PID 2960 wrote to memory of 3024	2960	powershell.exe	29
PID 2960 wrote to memory of 2260	2960	powershell.exe	30
PID 2960 wrote to memory of 2260	2960	powershell.exe	30
PID 2960 wrote to memory of 2260	2960	powershell.exe	30
PID 2960 wrote to memory of 2260	2960	powershell.exe	30

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.ps1
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.pdf"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2992
- C:\Users\Admin\AppData\Local\Temp\DriverDiagnoseTool.exe
  "C:\Users\Admin\AppData\Local\Temp\DriverDiagnoseTool.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3024
- C:\Users\Admin\AppData\Roaming\DriverDiagnoseTool.exe
  "C:\Users\Admin\AppData\Roaming\DriverDiagnoseTool.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f707205cdadc1d16cb7892b9e9c362d2

SHA1
793d5cae8d0c40d3f8478fd4822030e93808ffc5

SHA256
b7134a79e911d0dc1c1b27644f51c0c827cf801e681c8f5481b4093311e788ea

SHA512
257043deb8e6c50532178fce851583509a186c529a772062971b0cd581f2a2e551e4241d05cebf596766f0cef082c596c947f1115d8e289e3f0a408de7858f03

Download Submit
C:\Users\Admin\AppData\Roaming\DriverDiagnoseTool.exe

Filesize
300.9MB

MD5
d70de5a533c758bcba7ff16d204cdbe6

SHA1
38d9f39f8c3699c04c4e4ba3e33afbed745e3e8f

SHA256
40d348783300d039d969f27a22433a8cba8d31c28e2e8d542c10a5792d34c1d3

SHA512
a9355532ad9310a61f1b07926a64d48669ebf3e15e45c18a28a7b16c3e94d66037752d45b36e26c2dbb247b2d9fdcedc18f00fb4229daece372f44af418c07f1

Download Submit
C:\Users\Admin\AppData\Roaming\DriverDiagnoseTool.exe

Filesize
300.9MB

MD5
d70de5a533c758bcba7ff16d204cdbe6

SHA1
38d9f39f8c3699c04c4e4ba3e33afbed745e3e8f

SHA256
40d348783300d039d969f27a22433a8cba8d31c28e2e8d542c10a5792d34c1d3

SHA512
a9355532ad9310a61f1b07926a64d48669ebf3e15e45c18a28a7b16c3e94d66037752d45b36e26c2dbb247b2d9fdcedc18f00fb4229daece372f44af418c07f1

Download Submit
memory/2260-76-0x00000000004A0000-0x000000000056A000-memory.dmp

Filesize
808KB

Download
memory/2260-73-0x00000000004A0000-0x000000000056A000-memory.dmp

Filesize
808KB

Download
memory/2960-62-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/2960-58-0x000000001B0C0000-0x000000001B3A2000-memory.dmp

Filesize
2.9MB

Download
memory/2960-61-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/2960-60-0x0000000002870000-0x00000000028F0000-memory.dmp

Filesize
512KB

Download
memory/2960-59-0x00000000024F0000-0x00000000024F8000-memory.dmp

Filesize
32KB

Download
memory/3024-65-0x0000000000230000-0x00000000002FA000-memory.dmp

Filesize
808KB

Download
memory/3024-64-0x0000000000230000-0x00000000002FA000-memory.dmp

Filesize
808KB

Download
memory/3024-74-0x0000000000230000-0x00000000002FA000-memory.dmp

Filesize
808KB

Download
memory/3024-72-0x0000000000230000-0x00000000002FA000-memory.dmp

Filesize
808KB

Download
memory/3024-77-0x0000000000230000-0x00000000002FA000-memory.dmp

Filesize
808KB

Download
memory/3024-78-0x0000000000230000-0x00000000002FA000-memory.dmp

Filesize
808KB

Download
memory/3024-80-0x0000000000230000-0x00000000002FA000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing