Overview
overview
10Static
static
1Badlion Cl....1.dmg
macos-10.15-amd64
Badlion Cl...Client
macos-10.15-amd64
1Badlion Cl...ffmpeg
macos-10.15-amd64
Badlion Cl....8.jar
windows7-x64
1Badlion Cl....8.jar
windows10-2004-x64
10Badlion Cl....2.jar
windows7-x64
1Badlion Cl....2.jar
windows10-2004-x64
10Badlion Cl...25.jar
windows7-x64
1Badlion Cl...25.jar
windows10-2004-x64
10Badlion Cl....1.jar
windows7-x64
1Badlion Cl....1.jar
windows10-2004-x64
10Badlion Cl...er.jar
windows7-x64
1Badlion Cl...er.jar
windows10-2004-x64
10Analysis
-
max time kernel
89s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 15:53
Static task
static1
Behavioral task
behavioral1
Sample
Badlion Client-4.0.1.dmg
Resource
macos-20231201-en
Behavioral task
behavioral2
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/MacOS/Badlion Client
Resource
macos-20231201-en
Behavioral task
behavioral3
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/ffmpeg
Resource
macos-20231201-en
Behavioral task
behavioral4
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/caffeine-2.8.8.jar
Resource
win7-20231215-en
Behavioral task
behavioral5
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/caffeine-2.8.8.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral6
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/disruptor-3.4.2.jar
Resource
win7-20231215-en
Behavioral task
behavioral7
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/disruptor-3.4.2.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral8
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/joml-jdk8-1.9.25.jar
Resource
win7-20231129-en
Behavioral task
behavioral9
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/joml-jdk8-1.9.25.jar
Resource
win10v2004-20231215-en
Behavioral task
behavioral10
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/lz4-java-1.7.1.jar
Resource
win7-20231215-en
Behavioral task
behavioral11
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/lz4-java-1.7.1.jar
Resource
win10v2004-20231222-en
Behavioral task
behavioral12
Sample
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/optifineinstallwrapper.jar
Resource
win7-20231215-en
General
-
Target
Badlion Client 4.0.1/Badlion Client.app/Contents/libs/optifineinstallwrapper.jar
-
Size
3KB
-
MD5
8967319339fd7ff2a67b3a9eab3e4b93
-
SHA1
03e69508f50bffba71390c367fbc5e8c00d07335
-
SHA256
f4c5909042743c4a7206f52ae352fbfcad807185a985884314044b236ccb24c0
-
SHA512
e376022ce07135b77d46da898c27bf49239332e88410b4a20362e9f4ada0fb2a02b7cdbd00bfc0f11d3228ce56e77cd165b77baf41c21790dbb52ccf771555a1
Malware Config
Signatures
-
Modifies file permissions 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
java.exedescription pid process target process PID 4024 wrote to memory of 4988 4024 java.exe icacls.exe PID 4024 wrote to memory of 4988 4024 java.exe icacls.exe
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar "C:\Users\Admin\AppData\Local\Temp\Badlion Client 4.0.1\Badlion Client.app\Contents\libs\optifineinstallwrapper.jar"1⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M2⤵
- Modifies file permissions
PID:4988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestampFilesize
46B
MD5a0327c340bb13b17652c4f4a23657422
SHA1ad1f21acf8be20b78b5838c4b1814478a9b88754
SHA256c7fddf6b9639755a5c7dca4f8526930f8510f4211c9e70855252f114bb217993
SHA512c477889ef0c3468d35fa5b260111726e0dec6c9ef01d0e636896ff2fb27febf26603f6c264287c218680303d7cf3e137b6979f5a6b8d00cba658417a89932968
-
memory/4024-4-0x0000024549E40000-0x000002454AE40000-memory.dmpFilesize
16.0MB
-
memory/4024-12-0x0000024549E20000-0x0000024549E21000-memory.dmpFilesize
4KB