Resubmissions
19-04-2024 12:48
240419-p1rdtadh2y 10Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
19-04-2024 12:48
General
-
Target
Tests.exe
-
Size
355KB
-
MD5
b63e724ec24a8d07d17c91996c523917
-
SHA1
09a6e99e3dd4732eaf176d1d74fbc5e9aeaa5cbc
-
SHA256
6a5e7703d05bfd400d70aacb2a4ffee3226923c1efe7bcc9fe50ab0622d32ada
-
SHA512
c6a7afb56da65b6d50a34e322dbda77a41ad6ec3f954a1107630a4aedd74d631072931549e44386e9f6cab45ed1c7e72050884f58cddd2ff8366c213860522a6
-
SSDEEP
6144:kL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19I:kLdcfxaeM6fy/KaVUtgKkTZ73coNRJI
Score
10/10
Malware Config
Extracted
Family
babylonrat
C2
178.237.232.166
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tests.exe"C:\Users\Admin\AppData\Local\Temp\Tests.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB