babylonrat | f9c1f8d2c6382eb401fd9b4d74932310601f4751c90d5ee6b4d48450ceb67035

General

Target

0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe
Size

668KB
MD5

0d3ce4412083e13d4fb027654e2126ad
SHA1

c30f709f992cf158d772aff4c03ca487c5608b1c
SHA256

f9c1f8d2c6382eb401fd9b4d74932310601f4751c90d5ee6b4d48450ceb67035
SHA512

f28045463acda00a7fd3130e548f334d207757fd6be342dfcfe90b0d19de3422c250892130ea67cd3e35f87bdfa4a7213f4f28b59359b16c190bcb5eb88ff37c
SSDEEP

12288:k0v0okAQh7/ojoRgLwAQh7bsk0FbXS81+9V2IYu/1Brg7C2vw15iYfB:j+DojfK10F/g9VpT07W157f

Score

10^/10

babylonrat trojan upx

Malware Config

Extracted

Family

babylonrat

C2

lapoire2.hopto.org

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3056-5-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/3056-8-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/3056-9-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/3056-10-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/3056-11-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/3056-12-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/3056-13-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/3056-14-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/3056-15-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/3056-18-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral1/memory/3056-24-0x0000000000400000-0x00000000004C9000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 3056	1548	0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe	28

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3056	0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1548	0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3056	0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe
Token: SeDebugPrivilege	3056	0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe
Token: SeTcbPrivilege	3056	0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3056	0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3056	1548	0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe	28
PID 1548 wrote to memory of 3056	1548	0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe	28
PID 1548 wrote to memory of 3056	1548	0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe	28
PID 1548 wrote to memory of 3056	1548	0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe	28
PID 1548 wrote to memory of 3056	1548	0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0d3ce4412083e13d4fb027654e2126ad_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-0-0x0000000074B9E000-0x0000000074B9F000-memory.dmp

Filesize
4KB

Download
memory/1548-1-0x0000000000810000-0x00000000008BC000-memory.dmp

Filesize
688KB

Download
memory/1548-2-0x0000000000930000-0x000000000099E000-memory.dmp

Filesize
440KB

Download
memory/1548-3-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/1548-4-0x0000000000B80000-0x0000000000BE4000-memory.dmp

Filesize
400KB

Download
memory/1548-21-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/1548-6-0x0000000000300000-0x0000000000303000-memory.dmp

Filesize
12KB

Download
memory/3056-9-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3056-8-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3056-10-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3056-11-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3056-12-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3056-13-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3056-14-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3056-15-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3056-18-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3056-5-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3056-24-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download

Analysis

Sharing