babylonrat | b84ac29cbfcb743b84c24bb7eeb2d237c7e871c433c5d28122376ea4a8ff35fb

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Diln V1.exe
Size

426KB
MD5

a47a2e153ea58592d6b1af508d141887
SHA1

575f13613d90f3b1f6fae9379413f9b21d432c11
SHA256

b84ac29cbfcb743b84c24bb7eeb2d237c7e871c433c5d28122376ea4a8ff35fb
SHA512

26f6d7f0ee5354d2f343670180316fe08a2c90e44faa55be1bbb1f6b0ef579bfb957dae5668c2aba6a3715250b958ecef4c360f5fa43b5207cbb1405fe094a16
SSDEEP

12288:kLdcfxaeM6fy/KaVUtgKkTZ73coNRJn0:QkIZGSAtgN+eJn0

Score

10^/10

babylonrat trojan upx

Malware Config

Extracted

Family

babylonrat

91.242.155.129

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2260-0-0x0000000001230000-0x000000000131C000-memory.dmp	upx
behavioral1/memory/2884-2-0x0000000001230000-0x000000000131C000-memory.dmp	upx
behavioral1/memory/2260-3-0x0000000001230000-0x000000000131C000-memory.dmp	upx
behavioral1/memory/2528-6-0x0000000001230000-0x000000000131C000-memory.dmp	upx
behavioral1/memory/2884-5-0x00000000010A0000-0x000000000118C000-memory.dmp	upx
behavioral1/memory/2884-4-0x0000000001230000-0x000000000131C000-memory.dmp	upx
behavioral1/memory/2580-7-0x0000000001230000-0x000000000131C000-memory.dmp	upx
behavioral1/memory/2528-8-0x0000000001230000-0x000000000131C000-memory.dmp	upx
behavioral1/memory/2528-10-0x0000000001230000-0x000000000131C000-memory.dmp	upx
behavioral1/memory/2528-12-0x0000000001230000-0x000000000131C000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2528	Diln V1.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2260	Diln V1.exe
Token: SeDebugPrivilege	2260	Diln V1.exe
Token: SeTcbPrivilege	2260	Diln V1.exe
Token: SeShutdownPrivilege	2884	Diln V1.exe
Token: SeDebugPrivilege	2884	Diln V1.exe
Token: SeTcbPrivilege	2884	Diln V1.exe
Token: SeShutdownPrivilege	2528	Diln V1.exe
Token: SeDebugPrivilege	2528	Diln V1.exe
Token: SeTcbPrivilege	2528	Diln V1.exe
Token: SeShutdownPrivilege	2580	Diln V1.exe
Token: SeDebugPrivilege	2580	Diln V1.exe
Token: SeTcbPrivilege	2580	Diln V1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2528	Diln V1.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2884	2260	Diln V1.exe	28
PID 2260 wrote to memory of 2884	2260	Diln V1.exe	28
PID 2260 wrote to memory of 2884	2260	Diln V1.exe	28
PID 2260 wrote to memory of 2884	2260	Diln V1.exe	28
PID 2884 wrote to memory of 2528	2884	Diln V1.exe	29
PID 2884 wrote to memory of 2528	2884	Diln V1.exe	29
PID 2884 wrote to memory of 2528	2884	Diln V1.exe	29
PID 2884 wrote to memory of 2528	2884	Diln V1.exe	29
PID 2528 wrote to memory of 2580	2528	Diln V1.exe	30
PID 2528 wrote to memory of 2580	2528	Diln V1.exe	30
PID 2528 wrote to memory of 2580	2528	Diln V1.exe	30
PID 2528 wrote to memory of 2580	2528	Diln V1.exe	30

C:\Users\Admin\AppData\Local\Temp\Diln V1.exe
"C:\Users\Admin\AppData\Local\Temp\Diln V1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\Diln V1.exe
  "C:\Users\Admin\AppData\Local\Temp\Diln V1.exe" 2260
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Users\Admin\AppData\Local\Temp\Diln V1.exe
    "C:\Users\Admin\AppData\Local\Temp\Diln V1.exe"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Diln V1.exe
      "C:\Users\Admin\AppData\Local\Temp\Diln V1.exe" 2528
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-0-0x0000000001230000-0x000000000131C000-memory.dmp

Filesize
944KB

Download
memory/2260-1-0x00000000029F0000-0x0000000002ADC000-memory.dmp

Filesize
944KB

Download
memory/2260-3-0x0000000001230000-0x000000000131C000-memory.dmp

Filesize
944KB

Download
memory/2528-6-0x0000000001230000-0x000000000131C000-memory.dmp

Filesize
944KB

Download
memory/2528-8-0x0000000001230000-0x000000000131C000-memory.dmp

Filesize
944KB

Download
memory/2528-10-0x0000000001230000-0x000000000131C000-memory.dmp

Filesize
944KB

Download
memory/2528-12-0x0000000001230000-0x000000000131C000-memory.dmp

Filesize
944KB

Download
memory/2580-7-0x0000000001230000-0x000000000131C000-memory.dmp

Filesize
944KB

Download
memory/2884-2-0x0000000001230000-0x000000000131C000-memory.dmp

Filesize
944KB

Download
memory/2884-5-0x00000000010A0000-0x000000000118C000-memory.dmp

Filesize
944KB

Download
memory/2884-4-0x0000000001230000-0x000000000131C000-memory.dmp

Filesize
944KB

Download