Analysis
-
max time kernel
154s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 13:13
Behavioral task
behavioral1
Sample
Test2.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Test2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
Test2.exe
-
Size
355KB
-
MD5
7c06ee69dcf13a8242b92833ffd150bd
-
SHA1
7449480548cf9c8c073cab0181be5defd5669663
-
SHA256
f460741b752da6167c90fb9aa278f4efa7ebb1cad6ee366f62df9141fd50a767
-
SHA512
af9454dc35816647ed2f2024e807699365098ab99399ecfbf38efe7fd8c7ba3074843ca2478fb9612c98dadc5c3f4ea77f71c83c6ad4f508bccefc9c0937d8d4
-
SSDEEP
6144:tL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19k:tLdcfxaeM6fy/KaVUtgKkTZ73coNRJk
Score
10/10
Malware Config
Extracted
Family
babylonrat
C2
192.168.1.136
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
resource yara_rule behavioral2/memory/2036-0-0x0000000000840000-0x0000000000909000-memory.dmp upx behavioral2/memory/2036-1-0x0000000000840000-0x0000000000909000-memory.dmp upx behavioral2/memory/2036-15-0x0000000000840000-0x0000000000909000-memory.dmp upx behavioral2/memory/2640-16-0x0000000000840000-0x0000000000909000-memory.dmp upx behavioral2/memory/2036-19-0x0000000000840000-0x0000000000909000-memory.dmp upx behavioral2/memory/2036-21-0x0000000000840000-0x0000000000909000-memory.dmp upx behavioral2/memory/2036-29-0x0000000000840000-0x0000000000909000-memory.dmp upx behavioral2/memory/2036-31-0x0000000000840000-0x0000000000909000-memory.dmp upx behavioral2/memory/2036-33-0x0000000000840000-0x0000000000909000-memory.dmp upx -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2036 Test2.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 3952 taskmgr.exe Token: SeSystemProfilePrivilege 3952 taskmgr.exe Token: SeCreateGlobalPrivilege 3952 taskmgr.exe Token: SeShutdownPrivilege 2036 Test2.exe Token: SeDebugPrivilege 2036 Test2.exe Token: SeTcbPrivilege 2036 Test2.exe Token: SeShutdownPrivilege 2640 Test2.exe Token: SeDebugPrivilege 2640 Test2.exe Token: SeTcbPrivilege 2640 Test2.exe Token: 33 3952 taskmgr.exe Token: SeIncBasePriorityPrivilege 3952 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe 3952 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2036 Test2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2640 2036 Test2.exe 96 PID 2036 wrote to memory of 2640 2036 Test2.exe 96 PID 2036 wrote to memory of 2640 2036 Test2.exe 96
Processes
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3952
-
C:\Users\Admin\AppData\Local\Temp\Test2.exe"C:\Users\Admin\AppData\Local\Temp\Test2.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\Test2.exe"C:\Users\Admin\AppData\Local\Temp\Test2.exe" 20362⤵
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1028 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵PID:2020