babylonrat | ea8c4a6d9e6d8e9c9ed430f8a29760264dd7e4a438189a66d47c319b6c180981

General

Target

KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.ps1
Size

665B
MD5

6fb15b95d7c72e3ccbc83b37a41b45d4
SHA1

c5d8e777be55d08aeff6e3ab40b7768e446b5801
SHA256

36e08d17fb61edfd642fa968a62dcdd23c20952d9ac4550bb8e36ec908aff38b
SHA512

7f2072d027012ce27145787f3a2948f6f95bfccf0527ee444cd328243b0e18004bffe798320810ede91a02d38e0863a97248e376b15a75a6c763494fb06826c6

Score

10^/10

babylonrat persistence trojan upx

Malware Config

Extracted

Family

babylonrat

C2

149.28.19.207

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

Executes dropped EXE 1 IoCs

pid	Process
2096	DriverDiagnoseTool.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral7/memory/2252-61-0x00000000001C0000-0x000000000028A000-memory.dmp	upx
behavioral7/memory/2252-64-0x00000000001C0000-0x000000000028A000-memory.dmp	upx
behavioral7/memory/2252-66-0x00000000001C0000-0x000000000028A000-memory.dmp	upx
behavioral7/memory/2252-67-0x00000000001C0000-0x000000000028A000-memory.dmp	upx
behavioral7/memory/2252-69-0x00000000001C0000-0x000000000028A000-memory.dmp	upx
behavioral7/memory/2096-76-0x00000000005B0000-0x000000000067A000-memory.dmp	upx
behavioral7/memory/2096-77-0x00000000005B0000-0x000000000067A000-memory.dmp	upx
behavioral7/memory/2252-78-0x00000000001C0000-0x000000000028A000-memory.dmp	upx
behavioral7/memory/2252-79-0x00000000001C0000-0x000000000028A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Windows\CurrentVersion\Run\DriverDiagnoseTool = "C:\\Users\\Admin\\AppData\\Roaming\\DriverDiagnoseTool.exe"	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2104	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2252	DriverDiagnoseTool.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeShutdownPrivilege	2252	DriverDiagnoseTool.exe
Token: SeDebugPrivilege	2252	DriverDiagnoseTool.exe
Token: SeTcbPrivilege	2252	DriverDiagnoseTool.exe
Token: SeShutdownPrivilege	2096	DriverDiagnoseTool.exe
Token: SeDebugPrivilege	2096	DriverDiagnoseTool.exe
Token: SeTcbPrivilege	2096	DriverDiagnoseTool.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2988	AcroRd32.exe
2252	DriverDiagnoseTool.exe
2988	AcroRd32.exe
2988	AcroRd32.exe
2988	AcroRd32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2988	2104	powershell.exe	30
PID 2104 wrote to memory of 2988	2104	powershell.exe	30
PID 2104 wrote to memory of 2988	2104	powershell.exe	30
PID 2104 wrote to memory of 2988	2104	powershell.exe	30
PID 2104 wrote to memory of 2252	2104	powershell.exe	31
PID 2104 wrote to memory of 2252	2104	powershell.exe	31
PID 2104 wrote to memory of 2252	2104	powershell.exe	31
PID 2104 wrote to memory of 2252	2104	powershell.exe	31
PID 2104 wrote to memory of 2096	2104	powershell.exe	32
PID 2104 wrote to memory of 2096	2104	powershell.exe	32
PID 2104 wrote to memory of 2096	2104	powershell.exe	32
PID 2104 wrote to memory of 2096	2104	powershell.exe	32

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.ps1
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\KENAPA_UMNO_BERSAMA_KERAJAAN_PERPADUAN.pdf"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2988
- C:\Users\Admin\AppData\Local\Temp\DriverDiagnoseTool.exe
  "C:\Users\Admin\AppData\Local\Temp\DriverDiagnoseTool.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2252
- C:\Users\Admin\AppData\Roaming\DriverDiagnoseTool.exe
  "C:\Users\Admin\AppData\Roaming\DriverDiagnoseTool.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
91ffcbc97b7ed5a0d9cb6521b66d3491

SHA1
bca5b4de1d303343ae9b611c467b5c67a0240397

SHA256
1b9e25ba3b26a2db66899ffe265c67771e8ca04feec47be74037319bf426a4e9

SHA512
a7d8274b78109e23d4b59d5f59b3b2f6bf4dd88ad2e413a92990e8d5dba02def035fe3d067c73531ecf216ddd455ff88395d6f3dc0430074be1d87043c466753

Download Submit
C:\Users\Admin\AppData\Roaming\DriverDiagnoseTool.exe

Filesize
300.9MB

MD5
d70de5a533c758bcba7ff16d204cdbe6

SHA1
38d9f39f8c3699c04c4e4ba3e33afbed745e3e8f

SHA256
40d348783300d039d969f27a22433a8cba8d31c28e2e8d542c10a5792d34c1d3

SHA512
a9355532ad9310a61f1b07926a64d48669ebf3e15e45c18a28a7b16c3e94d66037752d45b36e26c2dbb247b2d9fdcedc18f00fb4229daece372f44af418c07f1

Download Submit
C:\Users\Admin\AppData\Roaming\DriverDiagnoseTool.exe

Filesize
300.9MB

MD5
d70de5a533c758bcba7ff16d204cdbe6

SHA1
38d9f39f8c3699c04c4e4ba3e33afbed745e3e8f

SHA256
40d348783300d039d969f27a22433a8cba8d31c28e2e8d542c10a5792d34c1d3

SHA512
a9355532ad9310a61f1b07926a64d48669ebf3e15e45c18a28a7b16c3e94d66037752d45b36e26c2dbb247b2d9fdcedc18f00fb4229daece372f44af418c07f1

Download Submit
memory/2096-77-0x00000000005B0000-0x000000000067A000-memory.dmp

Filesize
808KB

Download
memory/2096-76-0x00000000005B0000-0x000000000067A000-memory.dmp

Filesize
808KB

Download
memory/2104-63-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2104-58-0x000000001B1B0000-0x000000001B492000-memory.dmp

Filesize
2.9MB

Download
memory/2104-62-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2104-60-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2104-59-0x00000000022E0000-0x00000000022E8000-memory.dmp

Filesize
32KB

Download
memory/2252-64-0x00000000001C0000-0x000000000028A000-memory.dmp

Filesize
808KB

Download
memory/2252-66-0x00000000001C0000-0x000000000028A000-memory.dmp

Filesize
808KB

Download
memory/2252-67-0x00000000001C0000-0x000000000028A000-memory.dmp

Filesize
808KB

Download
memory/2252-69-0x00000000001C0000-0x000000000028A000-memory.dmp

Filesize
808KB

Download
memory/2252-61-0x00000000001C0000-0x000000000028A000-memory.dmp

Filesize
808KB

Download
memory/2252-78-0x00000000001C0000-0x000000000028A000-memory.dmp

Filesize
808KB

Download
memory/2252-79-0x00000000001C0000-0x000000000028A000-memory.dmp

Filesize
808KB

Download

Analysis

Sharing