babylonrat | 3be46c59383b8e526da6b254f499a1ee56b69e000221da42a83d3cef7849a7af

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 13:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
Size

355KB
MD5

91f10580739b5c0795f4ba2f6274775b
SHA1

6ab60fb701c2df5f5e113461c9f31249072224bb
SHA256

3be46c59383b8e526da6b254f499a1ee56b69e000221da42a83d3cef7849a7af
SHA512

2886924349a0ddc92368a9bb358576db44928bae041ca89501f4761cc04656d97dfbd323f99ec3e50146cca7a4f73ae5045b163ba9b46b529981c7c461d68919
SSDEEP

6144:uL1ncfWwN0oc35jeRh8Xqfy/Ka1OHAH0tMrKCTEABG+Z9d3cQT/9nR4Ioy19RI:uLdcfxaeM6fy/KaVUtgKkTZ73coNRJ

Score

10^/10

babylonrat trojan upx

Malware Config

Extracted

Family

babylonrat

calebv3rm.ddns.net

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3544-0-0x0000000000070000-0x0000000000139000-memory.dmp	upx
behavioral2/memory/1428-2-0x0000000000070000-0x0000000000139000-memory.dmp	upx
behavioral2/memory/3544-1-0x0000000000070000-0x0000000000139000-memory.dmp	upx
behavioral2/memory/3544-5-0x0000000000070000-0x0000000000139000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3544	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3544	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
Token: SeDebugPrivilege	3544	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
Token: SeTcbPrivilege	3544	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
Token: SeShutdownPrivilege	1428	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
Token: SeDebugPrivilege	1428	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
Token: SeTcbPrivilege	1428	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3544	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 1428	3544	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe	82
PID 3544 wrote to memory of 1428	3544	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe	82
PID 3544 wrote to memory of 1428	3544	91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Users\Admin\AppData\Local\Temp\91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\91f10580739b5c0795f4ba2f6274775b_JaffaCakes118.exe" 3544
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1428-2-0x0000000000070000-0x0000000000139000-memory.dmp

Filesize
804KB

Download
memory/3544-0-0x0000000000070000-0x0000000000139000-memory.dmp

Filesize
804KB

Download
memory/3544-1-0x0000000000070000-0x0000000000139000-memory.dmp

Filesize
804KB

Download
memory/3544-5-0x0000000000070000-0x0000000000139000-memory.dmp

Filesize
804KB

Download