babadeda | bd8d1264a88d5cdd701a4ee909b70beaec39d216c988b33bfb30f25aee3540ee

General

Target

04befedbe76440e1e24e59ff4244ce6a.exe
Size

8.9MB
MD5

04befedbe76440e1e24e59ff4244ce6a
SHA1

a8a2d779abb35bf23ba21575af1e95a2ecd17265
SHA256

bd8d1264a88d5cdd701a4ee909b70beaec39d216c988b33bfb30f25aee3540ee
SHA512

fa52f5bf9327ba9aade2cf8cc115b824761f45fe195079ec5738f71258e4cac8b1b33b3fba3954aef7aef92c44de47f249d3109f56f798f5ad7be49d9d37f0f2
SSDEEP

196608:YwX6s+9/A4IlpYpvG2OF+n4XRg2SS20yfdVJMjOK:YwX6s+9boYAhbgAy1vMKK

Score

10^/10

babadeda crypter loader

Malware Config

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Smart Cleanup\menu.xml	family_babadeda

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

04befedbe76440e1e24e59ff4244ce6a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	04befedbe76440e1e24e59ff4244ce6a.exe

Executes dropped EXE 1 IoCs

Processes:

SmartCleanup.exe

pid process

1536 SmartCleanup.exe
Loads dropped DLL 1 IoCs

Processes:

SmartCleanup.exe

pid process

1536 SmartCleanup.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

85 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1536	SmartCleanup.exe

pid	process
1536	SmartCleanup.exe

flow	ioc
85	api.ipify.org

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

04befedbe76440e1e24e59ff4244ce6a.exe

description	pid	process	target process
PID 1824 wrote to memory of 1536	1824	04befedbe76440e1e24e59ff4244ce6a.exe	SmartCleanup.exe
PID 1824 wrote to memory of 1536	1824	04befedbe76440e1e24e59ff4244ce6a.exe	SmartCleanup.exe
PID 1824 wrote to memory of 1536	1824	04befedbe76440e1e24e59ff4244ce6a.exe	SmartCleanup.exe

C:\Users\Admin\AppData\Local\Temp\04befedbe76440e1e24e59ff4244ce6a.exe
"C:\Users\Admin\AppData\Local\Temp\04befedbe76440e1e24e59ff4244ce6a.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1824

C:\Users\Admin\AppData\Roaming\Smart Cleanup\SmartCleanup.exe
"C:\Users\Admin\AppData\Roaming\Smart Cleanup\SmartCleanup.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\kaosdma.txt
Filesize
12B

MD5
8cf4dec152a9d79a3d62202b886eda9b

SHA1
0c1b3d3d02c0b655aa3526a58486b84872f18cc2

SHA256
c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01

SHA512
a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Cleanup\SmartCleanup.exe
Filesize
2.4MB

MD5
183f44ca3a4f33e88bf1d80566db603b

SHA1
87634a0e5b32587088d8d800049c56076db15e47

SHA256
5d92455f98253d7bdcd2a57d5cd73f749866794eb7730c2fa296800e45ceebb0

SHA512
b0cbf29e7dfec29830740cb13bbf11282794f9854bf2ecc574ade9f6d27994c2df1ec66ec22b7f490b45199ab9364abed02610fb120c3473959fed478c8f4299

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Cleanup\SmartCleanup.exe
Filesize
598KB

MD5
caee23d8e98273df92daabb889dba8a7

SHA1
fd60bc11426076a1485fbcd71fa26716cc584125

SHA256
df7cf012ae09f8db1bd8b7c1ea5dc200949d9f85aedcd6c282bc40e1eeeace6a

SHA512
7d7889e3d77d7406cf72c74789054cf5991323ccf89ed8a04abed091f18f8c007e651160f8014a8d1ca77c56ed0fcef77b624f15c0f9d8615f0dbbc8df38a20c

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Cleanup\SmartCleanup.exe
Filesize
571KB

MD5
6a375329aacf40e7d3e205b3cce8e806

SHA1
6b9750a1f84dbfe3710ab83900d62e79a58a8850

SHA256
03bcdf56ded7eaf83402048ed5db72941709bdb486fcc5ad03b06c0488ad3dc3

SHA512
74f28e8d92e2579f8262d6c6f2ee77e05001a19a358c8922353efde58e7fd037fc442e0d832df52ff99c3bb9f07b57e484aad771b1afa93f8162f4d475dba009

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Cleanup\libGLES-v2.dll
Filesize
510KB

MD5
abbf4b4e4aad7213ac3939668e23f852

SHA1
1b9d2ad0e5cdde8f3f497cfb07969a05f5047256

SHA256
8bbd280dffe1fd7947b54c56c7f57543b35e4b03b35c359599af313dd6877596

SHA512
3ebe9a0f17c24fcf83e264291b0a77deaf30e4da13bfc539081375db58b7e38329724847049b8adf77121c0998d95f3a4474b3fbc77c2a17a22c6489f779e4ac

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Cleanup\libGLES-v2.dll
Filesize
472KB

MD5
5e788e7e416cfaddae77c191e07936c6

SHA1
b44255d02dcbe89c30cfe57c05621e9872cf1361

SHA256
ae4f240cb74678005efb11dab65ef82a01b5619ae117b6c9e2a3f9c986a16b4b

SHA512
2a1b5580dbed340cd508fd0270d23297d69985e2e89a15fda83ee0c4a7a16898414754b4a12136edad8f0e94b1ffa25cb5b6e753a62c6e88ac7521a8c6639fa3

Download Submit
C:\Users\Admin\AppData\Roaming\Smart Cleanup\menu.xml
Filesize
455KB

MD5
a2ffbe69712106dc778625e3f55076da

SHA1
010f27681359f09dcce63349e5d7737c9b383eb7

SHA256
618ff25fa1dbd690b0fa884238ab12a110821edbd6988c053ac8f64fe002796c

SHA512
5621258333581ebc20dd40c0331751334cb3536ca4e9dc81b5ac3b4ff1b344f8dd56eb5ca3bcc749e341a22186e93cb4119900ca6e18e0742c145e0c648f61f9

Download Submit
memory/1536-557-0x0000000000400000-0x0000000000A0F000-memory.dmp

Filesize
6.1MB

Download
memory/1824-0-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/1824-561-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads