babylonrat | bf4391a80d1b0062f1f8bab43759981d971a5e8319aefb65273f3d276130c1fb

Analysis

max time kernel
144s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Diln External V3.exe
Size

426KB
MD5

c600a79fd780a84a5fed6af7c03767b7
SHA1

dcf2a842ebdd284136ad29915e5bc2541cef306d
SHA256

bf4391a80d1b0062f1f8bab43759981d971a5e8319aefb65273f3d276130c1fb
SHA512

188ec0ace793cf024cc3cad564e6832e3564c119dbbb3313f038d45e5df7dde2aed6bf3a83ba9cfb9591b99e4dc46f0d302731d8a2ef5508049983b37e5e57b2
SSDEEP

12288:HLdcfxaeM6fy/KaVUtgKkTZ73coNRJmj:rkIZGSAtgN+eJmj

Score

10^/10

babylonrat trojan upx

Malware Config

Extracted

Family

babylonrat

178.237.233.106

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3152-0-0x0000000000CD0000-0x0000000000DBC000-memory.dmp	upx
behavioral2/memory/3152-1-0x0000000000CD0000-0x0000000000DBC000-memory.dmp	upx
behavioral2/memory/636-2-0x0000000000CD0000-0x0000000000DBC000-memory.dmp	upx
behavioral2/memory/3152-3-0x0000000000CD0000-0x0000000000DBC000-memory.dmp	upx
behavioral2/memory/3152-7-0x0000000000CD0000-0x0000000000DBC000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3152	Diln External V3.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3152	Diln External V3.exe
Token: SeDebugPrivilege	3152	Diln External V3.exe
Token: SeTcbPrivilege	3152	Diln External V3.exe
Token: SeShutdownPrivilege	636	Diln External V3.exe
Token: SeDebugPrivilege	636	Diln External V3.exe
Token: SeTcbPrivilege	636	Diln External V3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3152	Diln External V3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 636	3152	Diln External V3.exe	92
PID 3152 wrote to memory of 636	3152	Diln External V3.exe	92
PID 3152 wrote to memory of 636	3152	Diln External V3.exe	92

C:\Users\Admin\AppData\Local\Temp\Diln External V3.exe
"C:\Users\Admin\AppData\Local\Temp\Diln External V3.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Users\Admin\AppData\Local\Temp\Diln External V3.exe
  "C:\Users\Admin\AppData\Local\Temp\Diln External V3.exe" 3152
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:5060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-2-0x0000000000CD0000-0x0000000000DBC000-memory.dmp

Filesize
944KB

Download
memory/3152-0-0x0000000000CD0000-0x0000000000DBC000-memory.dmp

Filesize
944KB

Download
memory/3152-1-0x0000000000CD0000-0x0000000000DBC000-memory.dmp

Filesize
944KB

Download
memory/3152-3-0x0000000000CD0000-0x0000000000DBC000-memory.dmp

Filesize
944KB

Download
memory/3152-7-0x0000000000CD0000-0x0000000000DBC000-memory.dmp

Filesize
944KB

Download