Overview
overview
10Static
static
1Badlion Cl....1.dmg
macos-10.15-amd64
Badlion Cl...Client
macos-10.15-amd64
1Badlion Cl...ffmpeg
macos-10.15-amd64
Badlion Cl....8.jar
windows7-x64
1Badlion Cl....8.jar
windows10-2004-x64
10Badlion Cl....2.jar
windows7-x64
1Badlion Cl....2.jar
windows10-2004-x64
10Badlion Cl...25.jar
windows7-x64
1Badlion Cl...25.jar
windows10-2004-x64
10Badlion Cl....1.jar
windows7-x64
1Badlion Cl....1.jar
windows10-2004-x64
10Badlion Cl...er.jar
windows7-x64
1Badlion Cl...er.jar
windows10-2004-x64
10Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 15:53
Static task
static1
Behavioral task
behavioral1
Sample
Badlion Client-4.0.1.dmg
Resource
macos-20231201-en
Behavioral task
behavioral2
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/MacOS/Badlion Client
Resource
macos-20231201-en
Behavioral task
behavioral3
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/ffmpeg
Resource
macos-20231201-en
Behavioral task
behavioral4
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/caffeine-2.8.8.jar
Resource
win7-20231215-en
Behavioral task
behavioral5
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/caffeine-2.8.8.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral6
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/disruptor-3.4.2.jar
Resource
win7-20231215-en
Behavioral task
behavioral7
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/disruptor-3.4.2.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral8
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/joml-jdk8-1.9.25.jar
Resource
win7-20231129-en
Behavioral task
behavioral9
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/joml-jdk8-1.9.25.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral10
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/lz4-java-1.7.1.jar
Resource
win7-20231215-en
Behavioral task
behavioral11
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/lz4-java-1.7.1.jar
Resource
win10v2004-20231222-en
Behavioral task
behavioral12
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/optifineinstallwrapper.jar
Resource
win7-20231215-en
General
-
Target
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/lz4-java-1.7.1.jar
-
Size
634KB
-
MD5
d56d86823662a663a4d614dd5e117eff
-
SHA1
c4d931ef8ad2c9c35d65b231a33e61428472d0da
-
SHA256
f1167a45d4b8002053670ef6991ca66d1bab9dcc03e4ef00183674d2f3fb9cac
-
SHA512
ff48daeca92c5a7657aa9c7fe41c5ae75a5fa0aad05c655bacb64a40acfe93ffd3d40bef16544614ce8a38db3e1df177023101773f6f7c1d32031413270e42d2
-
SSDEEP
12288:amEvKTPZYCwZmp59WR2/nfxHYub6OULsunu8wrqeWm7ahEqw0CwWF40vSumvh:dPZYCwUqcfF/6OULsuwrPd7ahEEWvvc
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 2976 wrote to memory of 412 2976 java.exe icacls.exe PID 2976 wrote to memory of 412 2976 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Badlion Client 4.0.1\Badlion Client.app\Contents\libs\lz4-java-1.7.1.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD577ec79790eeb724c663658afe377b1f0
SHA15b1f21f8db399fcf31cd3b4caaeb1b0b26ccef86
SHA256527358421588d7fec553b2308eec846d3fa05d04e9dc3ef1a62def763fc0ce13
SHA512090e2f4ce0f0038a7b098b20e12c474d4da7bbd65167ed65fbe2e38e744ceda8e09186e007a413da49d80fae89e5f96d3e4f0fb56ea0785aa823d76494d86434
-
memory/2976-4-0x000001F715470000-0x000001F716470000-memory.dmpFilesize
16.0MB
-
memory/2976-11-0x000001F713BB0000-0x000001F713BB1000-memory.dmpFilesize
4KB
-
memory/2976-13-0x000001F715470000-0x000001F716470000-memory.dmpFilesize
16.0MB