Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
31-10-2023 13:55
General
-
Target
162203827cddadcc6f1605f98cfdde7a6cd0ae2eab610428b1a55b3000dd79ba.exe
-
Size
355KB
-
MD5
6c968234b8d4a9fae56e630ea0db1044
-
SHA1
b0e8f0fbe4978c567e5534cb55ca090f750ee636
-
SHA256
162203827cddadcc6f1605f98cfdde7a6cd0ae2eab610428b1a55b3000dd79ba
-
SHA512
35f9139a1fad6eaddbc8b67bbee4a76c90f012dfc5367327d9033596482eb3697ec0d659167ffef918be80ba1f0761ef7a5843f3d2c3c1c5b5b722dfa87ec83d
-
SSDEEP
6144:ZL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19O:ZLdcfxaeM6fy/KaVUtgKkTZ73coNRJO
Score
10/10
Malware Config
Extracted
Family
babylonrat
C2
172.18.67.100
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\162203827cddadcc6f1605f98cfdde7a6cd0ae2eab610428b1a55b3000dd79ba.exe"C:\Users\Admin\AppData\Local\Temp\162203827cddadcc6f1605f98cfdde7a6cd0ae2eab610428b1a55b3000dd79ba.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB