babylonrat | ea8c4a6d9e6d8e9c9ed430f8a29760264dd7e4a438189a66d47c319b6c180981

General

Target

KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.lnk
Size

3KB
MD5

67919ac65f71daac11a70f8d9e9b75d3
SHA1

0ce2c4fe931dc3e711ea4af9913476a4e08fc7b2
SHA256

2c202c8fb88c907867f43a1d3c82a15b3b67204799efaed9e5cca2e150cdaacc
SHA512

c235a6a0913da127b70a46491e51d47813a3a7edcfcae6e1bcf1a06ccc418eb304ed05062fd6c84215533f8b30aea4e6dd3f59ad7c2b4ff2f9aab1a93914c533

Score

10^/10

babylonrat persistence trojan upx

Malware Config

Extracted

Family

babylonrat

C2

149.28.19.207

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

Executes dropped EXE 1 IoCs

pid	Process
2716	DriverDiagnoseTool.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/2064-116-0x0000000000150000-0x000000000021A000-memory.dmp	upx
behavioral3/memory/2064-117-0x0000000000150000-0x000000000021A000-memory.dmp	upx
behavioral3/memory/2064-118-0x0000000000150000-0x000000000021A000-memory.dmp	upx
behavioral3/memory/2064-119-0x0000000000150000-0x000000000021A000-memory.dmp	upx
behavioral3/memory/2064-121-0x0000000000150000-0x000000000021A000-memory.dmp	upx
behavioral3/memory/2064-129-0x0000000000150000-0x000000000021A000-memory.dmp	upx
behavioral3/memory/2716-130-0x0000000000270000-0x000000000033A000-memory.dmp	upx
behavioral3/memory/2716-131-0x0000000000270000-0x000000000033A000-memory.dmp	upx
behavioral3/memory/2064-149-0x0000000000150000-0x000000000021A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverDiagnoseTool = "C:\\Users\\Admin\\AppData\\Roaming\\DriverDiagnoseTool.exe"	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1532	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2064	DriverDiagnoseTool.exe
1124	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeShutdownPrivilege	2064	DriverDiagnoseTool.exe
Token: SeDebugPrivilege	2064	DriverDiagnoseTool.exe
Token: SeTcbPrivilege	2064	DriverDiagnoseTool.exe
Token: SeShutdownPrivilege	2716	DriverDiagnoseTool.exe
Token: SeDebugPrivilege	2716	DriverDiagnoseTool.exe
Token: SeTcbPrivilege	2716	DriverDiagnoseTool.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1124	AcroRd32.exe
2064	DriverDiagnoseTool.exe
1124	AcroRd32.exe
1124	AcroRd32.exe
1124	AcroRd32.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 960	3012	cmd.exe	29
PID 3012 wrote to memory of 960	3012	cmd.exe	29
PID 3012 wrote to memory of 960	3012	cmd.exe	29
PID 960 wrote to memory of 1532	960	cmd.exe	30
PID 960 wrote to memory of 1532	960	cmd.exe	30
PID 960 wrote to memory of 1532	960	cmd.exe	30
PID 1532 wrote to memory of 1124	1532	powershell.exe	31
PID 1532 wrote to memory of 1124	1532	powershell.exe	31
PID 1532 wrote to memory of 1124	1532	powershell.exe	31
PID 1532 wrote to memory of 1124	1532	powershell.exe	31
PID 1532 wrote to memory of 2064	1532	powershell.exe	32
PID 1532 wrote to memory of 2064	1532	powershell.exe	32
PID 1532 wrote to memory of 2064	1532	powershell.exe	32
PID 1532 wrote to memory of 2064	1532	powershell.exe	32
PID 1532 wrote to memory of 2716	1532	powershell.exe	33
PID 1532 wrote to memory of 2716	1532	powershell.exe	33
PID 1532 wrote to memory of 2716	1532	powershell.exe	33
PID 1532 wrote to memory of 2716	1532	powershell.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle hidden -nologo -executionpolicy bypass -File "KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.ps1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle hidden -nologo -executionpolicy bypass -File "KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.ps1"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.pdf"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\DriverDiagnoseTool.exe
      "C:\Users\Admin\AppData\Local\Temp\DriverDiagnoseTool.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2064
  - - C:\Users\Admin\AppData\Roaming\DriverDiagnoseTool.exe
      "C:\Users\Admin\AppData\Roaming\DriverDiagnoseTool.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9e23efdb124c387f0f50c74cce0f1186

SHA1
4b6e2a4bf1866ea10adb9784affc67b5c1b323b4

SHA256
48ded289499683f53802de5a253fa46002d8ac439bdd532b1cc4e83aa3fd3b99

SHA512
62b50b6b67724c9272d70227872de7553d51188554b987b27a31346db68235c18e4142248eca83de542a7e700f1a997893d93d61e3039b3d583e9774047518db

Download Submit
C:\Users\Admin\AppData\Roaming\DriverDiagnoseTool.exe

Filesize
300.9MB

MD5
d70de5a533c758bcba7ff16d204cdbe6

SHA1
38d9f39f8c3699c04c4e4ba3e33afbed745e3e8f

SHA256
40d348783300d039d969f27a22433a8cba8d31c28e2e8d542c10a5792d34c1d3

SHA512
a9355532ad9310a61f1b07926a64d48669ebf3e15e45c18a28a7b16c3e94d66037752d45b36e26c2dbb247b2d9fdcedc18f00fb4229daece372f44af418c07f1

Download Submit
C:\Users\Admin\AppData\Roaming\DriverDiagnoseTool.exe

Filesize
300.9MB

MD5
d70de5a533c758bcba7ff16d204cdbe6

SHA1
38d9f39f8c3699c04c4e4ba3e33afbed745e3e8f

SHA256
40d348783300d039d969f27a22433a8cba8d31c28e2e8d542c10a5792d34c1d3

SHA512
a9355532ad9310a61f1b07926a64d48669ebf3e15e45c18a28a7b16c3e94d66037752d45b36e26c2dbb247b2d9fdcedc18f00fb4229daece372f44af418c07f1

Download Submit
memory/1532-111-0x000000001B3C0000-0x000000001B6A2000-memory.dmp

Filesize
2.9MB

Download
memory/1532-112-0x0000000001EA0000-0x0000000001EA8000-memory.dmp

Filesize
32KB

Download
memory/1532-113-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/1532-114-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/1532-115-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/2064-119-0x0000000000150000-0x000000000021A000-memory.dmp

Filesize
808KB

Download
memory/2064-121-0x0000000000150000-0x000000000021A000-memory.dmp

Filesize
808KB

Download
memory/2064-118-0x0000000000150000-0x000000000021A000-memory.dmp

Filesize
808KB

Download
memory/2064-117-0x0000000000150000-0x000000000021A000-memory.dmp

Filesize
808KB

Download
memory/2064-129-0x0000000000150000-0x000000000021A000-memory.dmp

Filesize
808KB

Download
memory/2064-116-0x0000000000150000-0x000000000021A000-memory.dmp

Filesize
808KB

Download
memory/2064-149-0x0000000000150000-0x000000000021A000-memory.dmp

Filesize
808KB

Download
memory/2716-130-0x0000000000270000-0x000000000033A000-memory.dmp

Filesize
808KB

Download
memory/2716-131-0x0000000000270000-0x000000000033A000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing