babylonrat | b84ac29cbfcb743b84c24bb7eeb2d237c7e871c433c5d28122376ea4a8ff35fb

Analysis

max time kernel
141s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Diln V1.exe
Size

426KB
MD5

a47a2e153ea58592d6b1af508d141887
SHA1

575f13613d90f3b1f6fae9379413f9b21d432c11
SHA256

b84ac29cbfcb743b84c24bb7eeb2d237c7e871c433c5d28122376ea4a8ff35fb
SHA512

26f6d7f0ee5354d2f343670180316fe08a2c90e44faa55be1bbb1f6b0ef579bfb957dae5668c2aba6a3715250b958ecef4c360f5fa43b5207cbb1405fe094a16
SSDEEP

12288:kLdcfxaeM6fy/KaVUtgKkTZ73coNRJn0:QkIZGSAtgN+eJn0

Score

10^/10

babylonrat trojan upx

Malware Config

Extracted

Family

babylonrat

91.242.155.129

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2196-0-0x00000000012D0000-0x00000000013BC000-memory.dmp	upx
behavioral1/memory/1880-1-0x00000000012D0000-0x00000000013BC000-memory.dmp	upx
behavioral1/memory/2196-2-0x00000000012D0000-0x00000000013BC000-memory.dmp	upx
behavioral1/memory/1880-3-0x00000000012D0000-0x00000000013BC000-memory.dmp	upx
behavioral1/memory/2196-4-0x00000000012D0000-0x00000000013BC000-memory.dmp	upx
behavioral1/memory/2196-7-0x00000000012D0000-0x00000000013BC000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2196	Diln V1.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2196	Diln V1.exe
Token: SeDebugPrivilege	2196	Diln V1.exe
Token: SeTcbPrivilege	2196	Diln V1.exe
Token: SeShutdownPrivilege	1880	Diln V1.exe
Token: SeDebugPrivilege	1880	Diln V1.exe
Token: SeTcbPrivilege	1880	Diln V1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2196	Diln V1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 1880	2196	Diln V1.exe	28
PID 2196 wrote to memory of 1880	2196	Diln V1.exe	28
PID 2196 wrote to memory of 1880	2196	Diln V1.exe	28
PID 2196 wrote to memory of 1880	2196	Diln V1.exe	28

C:\Users\Admin\AppData\Local\Temp\Diln V1.exe
"C:\Users\Admin\AppData\Local\Temp\Diln V1.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Users\Admin\AppData\Local\Temp\Diln V1.exe
  "C:\Users\Admin\AppData\Local\Temp\Diln V1.exe" 2196
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1880-1-0x00000000012D0000-0x00000000013BC000-memory.dmp

Filesize
944KB

Download
memory/1880-3-0x00000000012D0000-0x00000000013BC000-memory.dmp

Filesize
944KB

Download
memory/2196-0-0x00000000012D0000-0x00000000013BC000-memory.dmp

Filesize
944KB

Download
memory/2196-2-0x00000000012D0000-0x00000000013BC000-memory.dmp

Filesize
944KB

Download
memory/2196-4-0x00000000012D0000-0x00000000013BC000-memory.dmp

Filesize
944KB

Download
memory/2196-6-0x0000000002A00000-0x0000000002AEC000-memory.dmp

Filesize
944KB

Download
memory/2196-7-0x00000000012D0000-0x00000000013BC000-memory.dmp

Filesize
944KB

Download