babylonrat | 6c90a79a689fe5e644eb84fa9841e651cc95ce72097d682782bf6a843cb74945

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2d025269f56867da66563db280ab6569_JaffaCakes118.exe
Size 2.7MB
Sample240510-df6gfsfa51
SHA256 6c90a79a689fe5e644eb84fa9841e651cc95ce72097d682782bf6a843cb74945
MD5 2d025269f56867da66563db280ab6569
SHA1 460574ed62cbeee67e8040664dfd6a8f00759887
SHA512 c12ca5eb92a0044d0e26ce19fd7784449b0411ba478c867fefd0cfd342ef4813cb21de489ce8104b1a7d4f5b78bafed90a1db9a26e4f3a186eb14c30fc9b4d35
SSDEEP 49152:2vPpaKDtcIycoXEfCt3FVo8NuKkM6NdW95YVViwkT7a6SnaBZezx1UdAI:UFMXEKt3Fm8NyM6NdW95Rw6gnI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

babylonrat persistence trojan upx

Malware Config

Extracted

Family

babylonrat

185.82.216.57

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

Executes dropped EXE 1 IoCs

pid	Process
4748	0.exe

Loads dropped DLL 1 IoCs

pid	Process
4748	0.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1500-0-0x0000000000400000-0x00000000004C9000-memory.dmp	upx
behavioral2/memory/1500-2-0x0000000000400000-0x00000000004C9000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12-7390514082-12-5-1-S\ = "C:\\12-7390514082-12-5-1-S\\S-1-5-21-2804150937-21.exe"	2d025269f56867da66563db280ab6569_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1500 set thread context of 1804	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	98

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe
1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe
1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe
1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe
1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe
1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe
1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe
1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe
1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe
1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1804	vbc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1804	vbc.exe
Token: SeDebugPrivilege	1804	vbc.exe
Token: SeTcbPrivilege	1804	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1804	vbc.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 4748	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	97
PID 1500 wrote to memory of 4748	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	97
PID 1500 wrote to memory of 4748	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	97
PID 1500 wrote to memory of 1804	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	98
PID 1500 wrote to memory of 1804	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	98
PID 1500 wrote to memory of 1804	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	98
PID 1500 wrote to memory of 1804	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	98
PID 1500 wrote to memory of 1804	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	98
PID 1500 wrote to memory of 2008	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	99
PID 1500 wrote to memory of 2008	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	99
PID 1500 wrote to memory of 2008	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	99
PID 1500 wrote to memory of 3992	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	100
PID 1500 wrote to memory of 3992	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	100
PID 1500 wrote to memory of 3992	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	100
PID 1500 wrote to memory of 4436	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	101
PID 1500 wrote to memory of 4436	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	101
PID 1500 wrote to memory of 4436	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	101
PID 1500 wrote to memory of 4796	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	104
PID 1500 wrote to memory of 4796	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	104
PID 1500 wrote to memory of 4796	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	104
PID 1500 wrote to memory of 4080	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	105
PID 1500 wrote to memory of 4080	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	105
PID 1500 wrote to memory of 4080	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	105
PID 1500 wrote to memory of 1668	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	106
PID 1500 wrote to memory of 1668	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	106
PID 1500 wrote to memory of 1668	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	106
PID 1500 wrote to memory of 4216	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	107
PID 1500 wrote to memory of 4216	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	107
PID 1500 wrote to memory of 4216	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	107
PID 1500 wrote to memory of 4336	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	108
PID 1500 wrote to memory of 4336	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	108
PID 1500 wrote to memory of 4336	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	108
PID 1500 wrote to memory of 2796	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	109
PID 1500 wrote to memory of 2796	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	109
PID 1500 wrote to memory of 2796	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	109
PID 1500 wrote to memory of 4944	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	110
PID 1500 wrote to memory of 4944	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	110
PID 1500 wrote to memory of 4944	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	110
PID 1500 wrote to memory of 1852	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	111
PID 1500 wrote to memory of 1852	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	111
PID 1500 wrote to memory of 1852	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	111
PID 1500 wrote to memory of 4968	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	112
PID 1500 wrote to memory of 4968	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	112
PID 1500 wrote to memory of 4968	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	112
PID 1500 wrote to memory of 4180	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	113
PID 1500 wrote to memory of 4180	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	113
PID 1500 wrote to memory of 4180	1500	2d025269f56867da66563db280ab6569_JaffaCakes118.exe	113

C:\Users\Admin\AppData\Local\Temp\2d025269f56867da66563db280ab6569_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2d025269f56867da66563db280ab6569_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\0.exe
  C:\Users\Admin\AppData\Local\Temp\0.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4748
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1804
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:2008
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:3992
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:4436
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:4796
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:4080
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:1668
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:4216
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:4336
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:2796
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:4944
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:1852
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:4968
- C:\Windows\SysWOW64\explorer.exe
  persistencecmd 1804 "C:\12-7390514082-12-5-1-S\S-1-5-21-2804150937-21.exe"
  2⤵
  PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0.exe

Path C:\Users\Admin\AppData\Local\Temp\0.exe
Size 1.6MB
SHA256 e12d2bd8e991ad1d5746ced8a8db8e13916f4fc04686ec8e599090b6ead411e0
MD5 130c5d73a3b905c3fac420a38cd3fa2e
SHA1 bc2c7ef8e28a9e3f6fda450c332d305496b07ce7
SHA512 1b7b44bcec635c6ee4aa770833085de098d37f6cfe93473fd1dbe714f7d097d5cf9e1aab79a7c037012c8f9f59fe9d03ba54f118d6aa384a9e792e50e551b0bd
SSDEEP 49152:W0ytjLPOUUsa6dEBvtUn2jsV2igky3GeU+Llcpeo:W0U3UZaEBvtmsc0GeU+Llc
MD5 SHA1 SHA512 SSDEEP

Submit Download

SciLexer.dll

Path C:\Users\Admin\AppData\Local\Temp\ScintillaNET\3.6.3\x86\SciLexer.dll
Size 943KB
SHA256 08f0cbbc5162f236c37166772be2c9b8ffd465d32df17ea9d45626c4ed2c911d
MD5 2ff7acfa80647ee46cc3c0e446327108
SHA1 c994820d03af722c244b046d1ee0967f1b5bc478
SHA512 50a9e20c5851d3a50f69651bc770885672ff4f97de32dfda55bf7488abd39a11e990525ec9152d250072acaad0c12a484155c31083d751668eb01addea5570cd
SSDEEP 24576:bY1+2o17X3i5aa5I6gs77y7yCxIOU5y0KFjV09OV:a+tDijO/kjCi80ijV0kV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1500-1-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Download

memory/1500-2-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/1500-4-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Download

memory/1500-0-0x0000000000400000-0x00000000004C9000-memory.dmp

Download

memory/1804-47-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1804-42-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1804-18-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1804-44-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1804-46-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1804-43-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1804-41-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1804-39-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/1804-51-0x0000000000400000-0x00000000004C2000-memory.dmp

Download

memory/4748-24-0x0000000074970000-0x0000000075120000-memory.dmp

Download

memory/4748-25-0x00000000079A0000-0x0000000007AF6000-memory.dmp

Download

memory/4748-30-0x000000000F410000-0x000000000F498000-memory.dmp

Download

memory/4748-31-0x000000000FCE0000-0x000000000FD02000-memory.dmp

Download

memory/4748-34-0x000000007497E000-0x000000007497F000-memory.dmp

Download

memory/4748-35-0x0000000074970000-0x0000000075120000-memory.dmp

Download

memory/4748-36-0x0000000074970000-0x0000000075120000-memory.dmp

Download

memory/4748-23-0x0000000006540000-0x000000000654A000-memory.dmp

Download

memory/4748-22-0x0000000074970000-0x0000000075120000-memory.dmp

Download

memory/4748-21-0x0000000002A70000-0x0000000002A76000-memory.dmp

Download

memory/4748-20-0x00000000076F0000-0x0000000007782000-memory.dmp

Download

memory/4748-19-0x0000000007C00000-0x00000000081A4000-memory.dmp

Download

memory/4748-17-0x0000000002BB0000-0x0000000002BE8000-memory.dmp

Download

memory/4748-16-0x0000000000780000-0x000000000091A000-memory.dmp

Download

memory/4748-15-0x000000007497E000-0x000000007497F000-memory.dmp

Download