Analysis
-
max time kernel
49s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28-12-2023 09:07
General
-
Target
d4efd4c8c02bf1c7130efdcf474f1b69.exe
-
Size
899KB
-
MD5
d4efd4c8c02bf1c7130efdcf474f1b69
-
SHA1
3f17c11369338e6767fe0dade8a0f9dbc7ddac27
-
SHA256
c7e1a1b08de4b6e01a17e4c4d5795964dae98aadba3fdd3ff5da33fc5adae7f6
-
SHA512
9e8da8bd66fb3771523c98eb58ed343f3c360e67cb3978a332c176c5e8e4717a6a0ecb391118812b8d76be92637c88d3ffc10c82769cf96a1d1d5b3abf4f8e78
-
SSDEEP
24576:dLJEU63Vi1wZDIzR2D4M0Q2VVFByf9djCf:xJJGZDn46abB4dO
Malware Config
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
Detect ZGRat V1 34 IoCs
-
ZGRat
ZGRat is remote access trojan written in C#.
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4efd4c8c02bf1c7130efdcf474f1b69.exe"C:\Users\Admin\AppData\Local\Temp\d4efd4c8c02bf1c7130efdcf474f1b69.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Lhzbhsndksibtmsrzld.vbs"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\chromes.exe'3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\d4efd4c8c02bf1c7130efdcf474f1b69.exeC:\Users\Admin\AppData\Local\Temp\d4efd4c8c02bf1c7130efdcf474f1b69.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 2203⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
632KB
-
Filesize
488KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
256KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
256KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
256KB
-
Filesize
920KB
-
Filesize
6.9MB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
468KB
-
Filesize
6.9MB