babadeda | 7d580d1416efb8a4475d4d682ca4e53b96482ef437770e66cb2ca8bcfbc075c9

Analysis

max time kernel
209s
max time network
49s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

150857f47c2baeebe41028b415ba30ec.exe
Size

6.4MB
MD5

150857f47c2baeebe41028b415ba30ec
SHA1

04c42c467ecfb1ba1be93ea8d093514581b72c92
SHA256

7d580d1416efb8a4475d4d682ca4e53b96482ef437770e66cb2ca8bcfbc075c9
SHA512

34e14180c9643c13a41c5c2aba823191cbc6b3d77c355bb0150bb93bca8d8bda40c77b0dde4171a58e4ec7c17d1b1133d9b8603b6534f921d4535b45c6cca30e
SSDEEP

196608:nA2vkEyBJxdhAkbGxTmN98gQKba9JmbMPfrI8:5vy+TmfzpbWJUMPfrI8

Score

10^/10

babadeda crypter loader

Malware Config

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Colasoft\Capsa11Free\base.xml	family_babadeda

Executes dropped EXE 1 IoCs

Processes:

xrengine.exe

pid process

2340 xrengine.exe
Loads dropped DLL 2 IoCs

Processes:

150857f47c2baeebe41028b415ba30ec.exexrengine.exe

pid process

2416 150857f47c2baeebe41028b415ba30ec.exe
2340 xrengine.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

xrengine.exe

pid process

2340 xrengine.exe

pid	process
2340	xrengine.exe

pid	process
2416	150857f47c2baeebe41028b415ba30ec.exe
2340	xrengine.exe

pid	process
2340	xrengine.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

150857f47c2baeebe41028b415ba30ec.exe

description	pid	process	target process
PID 2416 wrote to memory of 2340	2416	150857f47c2baeebe41028b415ba30ec.exe	xrengine.exe
PID 2416 wrote to memory of 2340	2416	150857f47c2baeebe41028b415ba30ec.exe	xrengine.exe
PID 2416 wrote to memory of 2340	2416	150857f47c2baeebe41028b415ba30ec.exe	xrengine.exe
PID 2416 wrote to memory of 2340	2416	150857f47c2baeebe41028b415ba30ec.exe	xrengine.exe

C:\Users\Admin\AppData\Local\Temp\150857f47c2baeebe41028b415ba30ec.exe
"C:\Users\Admin\AppData\Local\Temp\150857f47c2baeebe41028b415ba30ec.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416

C:\Users\Admin\AppData\Roaming\Colasoft\Capsa11Free\xrengine.exe
C:\Users\Admin\AppData\Roaming\Colasoft\Capsa11Free\xrengine.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2340

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Colasoft\Capsa11Free\JdbcOdbc.dll
Filesize
2.8MB

MD5
ae579e792f697b49ab65ddc49b513041

SHA1
ddacc12dbdf3942ebbacb88096668f1300d2c990

SHA256
29a8ca5ecce3ec352181e4da596e9d6e8f2405092118ba96749ff61ed8098d84

SHA512
315edc8d139396a60da7eb24ae9e3b54fac5b918910d97e97a7be479da9383fa3229e24c87defe1b7fb09f4d8880ab0554bf40e9d3d06a0668191e6f54a2b6f7

Download Submit
C:\Users\Admin\AppData\Roaming\Colasoft\Capsa11Free\base.xml
Filesize
863KB

MD5
51599707dc82f6946f39a87c5ac9fcd7

SHA1
f23db51bfe863a3ac1362ce131f5645e9f8b614e

SHA256
0be18ef99cfd38e7c43ef01f270778c46b46a43d5b7cdc81e7f83f91729609ca

SHA512
ab0669617b3d826a6b45e5fa2a814acb0ef0d2cb4d63dafa6e72156b158334d21af47c423f560cd4fdbb8657c78aa0037383611d06c66745e74873b32c68c69e

Download Submit
C:\Users\Admin\AppData\Roaming\Colasoft\Capsa11Free\xrengine.exe
Filesize
874KB

MD5
846eb78bc7dfaf8b661c3ce529be7f56

SHA1
01c82f1791611b57f0d704533a91fce4da91c3eb

SHA256
0027c2bf63938d8512fd710d1fd0b8cd0d6368ff18df05d9d66f9ef73fb54088

SHA512
3d3fb50bc42392987ba042025a4d0c61907044946f500b91fbde1a589d80a4ef0cabea19d5988487830b6d246e09315caa3ebc6b7bec7a1c377e39061a413c71

Download Submit
\Users\Admin\AppData\Roaming\Colasoft\Capsa11Free\JdbcOdbc.dll
Filesize
4.0MB

MD5
2d74780cb8efdd7038d663f5ea35a38d

SHA1
337c81688c22cbf5df03848d5fd617bca25848dc

SHA256
9750f93885304887d088e68737827cb970943d000ccd4245e6e7fdb55b0a9606

SHA512
ab9e6b9c76e0d10fcbedeba558aa25a3adeb1a3e9107ece02b20e5a25a1d0196b5bd6cf62ebae206ad3c72c1dbf70b0024beff2b64f21d7a83fbe899623bdec8

Download Submit
\Users\Admin\AppData\Roaming\Colasoft\Capsa11Free\xrengine.exe
Filesize
1.1MB

MD5
0f9210c3a6b12248b281b4b9015491e5

SHA1
5201fd2f0cf319e8076a7fc693ef2fb3a3c1147a

SHA256
6dc84b136a6bdb51cb98f7668f66bc7fac776856797db175435bed73f708555b

SHA512
fe2d6ebb5d8a4163857f54e94011b6549f2efc32d76e88c42bf1aa432545280fdb283fcc9922014f115b14e9a7f26411e3d863bc4ad16313317e46adb7dd34dc

Download Submit
memory/2340-242-0x0000000000400000-0x0000000000B76000-memory.dmp

Filesize
7.5MB

Download
memory/2340-246-0x0000000000400000-0x0000000000B76000-memory.dmp

Filesize
7.5MB

Download
memory/2416-241-0x00000000023B0000-0x0000000002B26000-memory.dmp

Filesize
7.5MB

Download