babylonrat | 9b793748195694101c7dc362a6b3c16c549fcc3c25803c7d79633de6fbd8f267

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe
Size

988KB
MD5

f5c544c32423a784af1339a5ab9b9084
SHA1

dd6ef46605985c44ae4ad73bafebbfd1c6bfa7a4
SHA256

9b793748195694101c7dc362a6b3c16c549fcc3c25803c7d79633de6fbd8f267
SHA512

6eaed9ee7ff2efd892414956799fc3084a8bff19a8ad142a8f96aecdbefe82cef5835ec79707f3eb7d31574284452c93120b2d002bde5a10888c4aa074374d84
SSDEEP

24576:DIW+2b4W4DEla27+HiKS+YEZs0Cigy67hC:/EEd7bh

Score

10^/10

babylonrat zgrat rat trojan upx

Malware Config

Extracted

Family

babylonrat

andronmatskiv20.sytes.net

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/1592-8-0x0000000005DC0000-0x0000000005E2C000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-9-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-10-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-12-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-14-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-16-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-18-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-20-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-22-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-24-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-26-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-28-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-30-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-32-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-34-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-36-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-38-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-40-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-42-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-44-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-46-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-48-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-50-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-54-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-52-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-56-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-58-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-60-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-63-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-65-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-67-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-69-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-71-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1
behavioral2/memory/1592-73-0x0000000005DC0000-0x0000000005E26000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2064-1919-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral2/memory/2064-1933-0x0000000000400000-0x00000000004C9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1592 set thread context of 2064	1592	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1592	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe
1592	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2064	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe
Token: SeShutdownPrivilege	2064	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe
Token: SeDebugPrivilege	2064	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe
Token: SeTcbPrivilege	2064	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2064	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2064	1592	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe	94
PID 1592 wrote to memory of 2064	1592	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe	94
PID 1592 wrote to memory of 2064	1592	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe	94
PID 1592 wrote to memory of 2064	1592	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe	94
PID 1592 wrote to memory of 2064	1592	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe	94
PID 1592 wrote to memory of 2064	1592	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe	94
PID 1592 wrote to memory of 2064	1592	f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Local\Temp\f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\f5c544c32423a784af1339a5ab9b9084_JaffaCakes118.exe
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1592-1-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/1592-0-0x0000000000EF0000-0x0000000000FEE000-memory.dmp

Filesize
1016KB

Download
memory/1592-2-0x0000000006050000-0x00000000065F4000-memory.dmp

Filesize
5.6MB

Download
memory/1592-3-0x0000000005980000-0x0000000005A12000-memory.dmp

Filesize
584KB

Download
memory/1592-4-0x0000000005B60000-0x0000000005B70000-memory.dmp

Filesize
64KB

Download
memory/1592-5-0x0000000005A30000-0x0000000005A3A000-memory.dmp

Filesize
40KB

Download
memory/1592-6-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/1592-7-0x0000000006D00000-0x0000000006D98000-memory.dmp

Filesize
608KB

Download
memory/1592-8-0x0000000005DC0000-0x0000000005E2C000-memory.dmp

Filesize
432KB

Download
memory/1592-9-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-10-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-12-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-14-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-16-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-18-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-20-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-22-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-24-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-26-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-28-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-30-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-32-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-34-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-36-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-38-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-40-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-42-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-44-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-46-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-48-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-50-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-54-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-52-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-56-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-58-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-60-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-63-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-62-0x0000000005B60000-0x0000000005B70000-memory.dmp

Filesize
64KB

Download
memory/1592-65-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-67-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-69-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-71-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-73-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/1592-1920-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/2064-1919-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/2064-1933-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download