babylonrat | 3be46c59383b8e526da6b254f499a1ee56b69e000221da42a83d3cef7849a7af

Analysis

max time kernel
145s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
Size

355KB
MD5

91f10580739b5c0795f4ba2f6274775b
SHA1

6ab60fb701c2df5f5e113461c9f31249072224bb
SHA256

3be46c59383b8e526da6b254f499a1ee56b69e000221da42a83d3cef7849a7af
SHA512

2886924349a0ddc92368a9bb358576db44928bae041ca89501f4761cc04656d97dfbd323f99ec3e50146cca7a4f73ae5045b163ba9b46b529981c7c461d68919
SSDEEP

6144:uL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19RI:uLdcfxaeM6fy/KaVUtgKkTZ73coNRJ

Score

10^/10

babylonrat trojan upx

Malware Config

Extracted

Family

babylonrat

calebv3rm.ddns.net

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/756-0-0x0000000000C00000-0x0000000000CC9000-memory.dmp	upx
behavioral1/memory/2536-1-0x0000000000C00000-0x0000000000CC9000-memory.dmp	upx
behavioral1/memory/756-2-0x0000000000C00000-0x0000000000CC9000-memory.dmp	upx
behavioral1/memory/2536-3-0x0000000000C00000-0x0000000000CC9000-memory.dmp	upx
behavioral1/memory/756-6-0x0000000000C00000-0x0000000000CC9000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
756	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	756	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
Token: SeDebugPrivilege	756	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
Token: SeTcbPrivilege	756	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
Token: SeShutdownPrivilege	2536	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
Token: SeDebugPrivilege	2536	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
Token: SeTcbPrivilege	2536	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
756	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2536	756	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe	28
PID 756 wrote to memory of 2536	756	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe	28
PID 756 wrote to memory of 2536	756	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe	28
PID 756 wrote to memory of 2536	756	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe" 756
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-0-0x0000000000C00000-0x0000000000CC9000-memory.dmp

Filesize
804KB

Download
memory/756-2-0x0000000000C00000-0x0000000000CC9000-memory.dmp

Filesize
804KB

Download
memory/756-6-0x0000000000C00000-0x0000000000CC9000-memory.dmp

Filesize
804KB

Download
memory/756-7-0x0000000002A10000-0x0000000002AD9000-memory.dmp

Filesize
804KB

Download
memory/2536-1-0x0000000000C00000-0x0000000000CC9000-memory.dmp

Filesize
804KB

Download
memory/2536-3-0x0000000000C00000-0x0000000000CC9000-memory.dmp

Filesize
804KB

Download