Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
04-01-2024 07:10
General
-
Target
4037cfec21b00f6439e37a3c45f36e66.exe
-
Size
355KB
-
MD5
4037cfec21b00f6439e37a3c45f36e66
-
SHA1
47d064bf3480ae850e23c51e728a90ba5c5d2734
-
SHA256
4278064ec50f87bb0471053c068b13955ed9d599434e687a64bf2060438a7511
-
SHA512
261ea33d505045515e27679e487d5796c19286b3d6aca30ee3c6f9d5e3e1b67ac2b60540acb57e38ca08ed7043e3a60e665380895311905183cfa0e18abac449
-
SSDEEP
6144:DL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19s:DLdcfxaeM6fy/KaVUtgKkTZ73coNRJ
Score
10/10
Malware Config
Extracted
Family
babylonrat
C2
88.99.99.222
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4037cfec21b00f6439e37a3c45f36e66.exe"C:\Users\Admin\AppData\Local\Temp\4037cfec21b00f6439e37a3c45f36e66.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB