babylonrat | f460741b752da6167c90fb9aa278f4efa7ebb1cad6ee366f62df9141fd50a767

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 13:13 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Test2.exe
Size

355KB
MD5

7c06ee69dcf13a8242b92833ffd150bd
SHA1

7449480548cf9c8c073cab0181be5defd5669663
SHA256

f460741b752da6167c90fb9aa278f4efa7ebb1cad6ee366f62df9141fd50a767
SHA512

af9454dc35816647ed2f2024e807699365098ab99399ecfbf38efe7fd8c7ba3074843ca2478fb9612c98dadc5c3f4ea77f71c83c6ad4f508bccefc9c0937d8d4
SSDEEP

6144:tL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19k:tLdcfxaeM6fy/KaVUtgKkTZ73coNRJk

Score

10^/10

babylonrat trojan upx

Malware Config

Extracted

Family

babylonrat

192.168.1.136

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1712-0-0x0000000001080000-0x0000000001149000-memory.dmp	upx
behavioral1/memory/2612-1-0x0000000001080000-0x0000000001149000-memory.dmp	upx
behavioral1/memory/1712-2-0x0000000001080000-0x0000000001149000-memory.dmp	upx
behavioral1/memory/2612-3-0x0000000001080000-0x0000000001149000-memory.dmp	upx
behavioral1/memory/1712-4-0x0000000001080000-0x0000000001149000-memory.dmp	upx
behavioral1/memory/1712-7-0x0000000001080000-0x0000000001149000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1712	Test2.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1712	Test2.exe
Token: SeDebugPrivilege	1712	Test2.exe
Token: SeTcbPrivilege	1712	Test2.exe
Token: SeShutdownPrivilege	2612	Test2.exe
Token: SeDebugPrivilege	2612	Test2.exe
Token: SeTcbPrivilege	2612	Test2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1712	Test2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2612	1712	Test2.exe	28
PID 1712 wrote to memory of 2612	1712	Test2.exe	28
PID 1712 wrote to memory of 2612	1712	Test2.exe	28
PID 1712 wrote to memory of 2612	1712	Test2.exe	28

C:\Users\Admin\AppData\Local\Temp\Test2.exe
"C:\Users\Admin\AppData\Local\Temp\Test2.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\Test2.exe
  "C:\Users\Admin\AppData\Local\Temp\Test2.exe" 1712
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2612

Network

No results found

192.168.1.136:20000

Test2.exe

152 B
3
192.168.1.136:20000

Test2.exe

152 B
3
192.168.1.136:20000

Test2.exe

152 B
3
192.168.1.136:20000

Test2.exe

152 B
3
192.168.1.136:20000

Test2.exe

152 B
3
192.168.1.136:20000

Test2.exe

152 B
3

No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1712-0-0x0000000001080000-0x0000000001149000-memory.dmp

Filesize
804KB

Download
memory/1712-2-0x0000000001080000-0x0000000001149000-memory.dmp

Filesize
804KB

Download
memory/1712-4-0x0000000001080000-0x0000000001149000-memory.dmp

Filesize
804KB

Download
memory/1712-6-0x0000000000B60000-0x0000000000C29000-memory.dmp

Filesize
804KB

Download
memory/1712-7-0x0000000001080000-0x0000000001149000-memory.dmp

Filesize
804KB

Download
memory/2612-1-0x0000000001080000-0x0000000001149000-memory.dmp

Filesize
804KB

Download
memory/2612-3-0x0000000001080000-0x0000000001149000-memory.dmp

Filesize
804KB

Download