Analysis
-
max time kernel
407s -
max time network
396s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
29-06-2024 19:36
General
-
Target
Babylon 1.6.0.0/Babylon RAT.exe
-
Size
6.7MB
-
MD5
aecdce1d7e2a637d1dcacd2b4580487b
-
SHA1
d5cd12f7a18d6777c9ec8458694aa3a74fd23701
-
SHA256
9157a48c53ca7a4543bac5b771886c87ea407bab6bbb053b50bc22709111d572
-
SHA512
8bb5ad64f1b2e75e47c4671396a713018c74c44e84803887c6b4a200ea85f4c020ccfe15211af3899cdcf9d0f46ef994bfd939e462f61062044874f7a64d7a35
-
SSDEEP
98304:KbldsCQTcsBL54TRRTk3w0ZIWoPzSSosDlh7OLifNLxu2UVaCS2e7Csb6j9cgl36:GnPsHqRwvoPzSSosDlhCKzi9/2BO4T
Malware Config
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 15 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 32 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 39 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Babylon 1.6.0.0\Babylon RAT.exe"C:\Users\Admin\AppData\Local\Temp\Babylon 1.6.0.0\Babylon RAT.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Babylon 1.6.0.0\upx.exe"C:\Users\Admin\AppData\Local\Temp\Babylon 1.6.0.0\upx.exe" "C:\Users\Admin\Desktop\ConvertBackup.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Babylon 1.6.0.0\upx.exe"C:\Users\Admin\AppData\Local\Temp\Babylon 1.6.0.0\upx.exe" "C:\Users\Admin\Downloads\so.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\ConvertBackup.exe"C:\Users\Admin\Desktop\ConvertBackup.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\ConvertBackup.exe"C:\Users\Admin\Desktop\ConvertBackup.exe" 46082⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Desktop\ConvertBackup.exe"C:\Users\Admin\Desktop\ConvertBackup.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\ConvertBackup.exe"C:\Users\Admin\Desktop\ConvertBackup.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\ConvertBackup.exe"C:\Users\Admin\Desktop\ConvertBackup.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\ConvertBackup.exe"C:\Users\Admin\Desktop\ConvertBackup.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\so.exe"C:\Users\Admin\Downloads\so.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\so.exe"C:\Users\Admin\Downloads\so.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\so.exe"C:\Users\Admin\Downloads\so.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\so.exe"C:\Users\Admin\Downloads\so.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\so.exe"C:\Users\Admin\Downloads\so.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\so.exe"C:\Users\Admin\Downloads\so.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -nohome1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1216 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\so.exe"C:\Users\Admin\Downloads\so.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD55f4f6ba1d092e87463c6b144c36d5e0b
SHA1e04501552ad18dd8acee69a83aed20c84fd5d87f
SHA2564eeb694729c800bb341af1c9459c5b9e1868d1318dec8ba2e729d5e09b037a75
SHA51259395385ffd0f89694ab9b26fe0325cad100b416022b1cc99d799668ec414fea84f989d3b561fe44f29fd9c494898f829f6e0c80c58b162897385d5e30c23a7c
-
Filesize
14KB
MD5af170bdfee69643d94e3d5416e0d45ec
SHA12b5b4739572413e00c74ce35ce0584cdecba5352
SHA2566ae109d44ca9410dc443a765b227c395dc39193b01f41bf0fb7c84233f2242e5
SHA51200a6d2491cabc5caba23db9c8c484ed70a467c4322ffb636988a6512ac9fe176705105d1f832517248a7f19eb9c344f7384edbd6c1d7c3d38da798122b108cac
-
Filesize
298KB
MD5e9eacbb7ab4b3f66019e0a2f13a1dba9
SHA1ae30894b29e52bf04afc4a54795d438fb910acff
SHA2560c3dc789d0a46493bd097526b920d913d930d96b1052cb331eec3ac560c89996
SHA512925445d20c93c65a282fc59f773551d824bff1f8e2623fd8ea0c587831a9550c400f121defb3d82c8f0401903fa69e3154dc98e29688d02af1d5d01247914a06
-
Filesize
278B
MD58dd990d12559c3e321c5c681b9a6caa3
SHA177ab59c8b6eabccc6dd79be4934fbf4aeb1a2604
SHA256bf6fb8de6c80f69394dbc4f58cdd114b249bccbb32eac05dca07b0964ab1225c
SHA51204986c0f2a52af7b4469bf05b825dec0401c1825287adbefdee679dc3a3c9c15598035c8b83ce634e08556568c6b3d16a4660d681cfb92d69914bc33cc1218a1
-
Filesize
408B
MD547d41e011b172b326153adac8bfe2e97
SHA1c4da396cbf67832e06ff7e554c0efa1dc5f69168
SHA2563596225a2e465f7338a8fa9c9baf01e1e55b889bb5a6e5e34f38c104ef1006e4
SHA512209872e348f104d1c7c8c711f89f46845960e1eaa687fae423db72ab07050a3f916aa971e4d0be3219df82047bc3a2ac5e68349048a6a55d3af7f9b187d8d6ac
-
Filesize
78B
MD59859b4b77752963f9b1271b7a71187c0
SHA121233c26f23d96a3e13dda9079664d2fc30f9bec
SHA2563ec3260363e5f0483802aba421c0226a5a0aa252efa76a78b85c7d670369d083
SHA5128592ab5d1eac930490c21110c478f2ab4fb5bef67386c92c897537becb98d3c0d1ad2b589f85db5648e9f4a62d93b164f50e1dfaea42e1a27482424165d19803
-
Filesize
198B
MD5d7d9f6e67967e942d8fdf4b9b3c4cae5
SHA1f5ff3db2c9b53427ba480d0f07d7997302a23714
SHA2562fab823e075195188905834edc440cceae6aa9a164fdb4cd590448fde6d140b6
SHA5124e853a5306e1cc93b567ef131d814b1b44a0b85b4a507e1aa072888eb4560e445baed9e3368ed057053cf6b125b320f2f558690637d0dc96bc62b5721cce851d
-
Filesize
328B
MD59f06d8b17aa9c2bd7f824a70cbab544e
SHA1750c62980d41da64c7858825d3ffd98cca3d419f
SHA256eba775cbbd4c2ce7d77d542d785b724f5fa712b683a600caa278ee78bb615e28
SHA512b0337e6b3b63121a9d9aa6695eb07fd5320319a7154f155f081f342e3dc095483b64bfc447f319c9bc0899479e88270714c29242908fb4604c1a476293d6adf2
-
Filesize
733KB
MD5eace92a8ab5f0c2fd69aa465a3ce7ce1
SHA1434c4dcbbb358e498db200b0a1c8ddd7ee7b5663
SHA25630a7c06f7c6bcfb1f268869ea881021af7c6d3524539d60bf965ded71852331b
SHA512868a23c27ed81e264a284b8a00229fb0758e20331a956dff2dd88572cc719773c305aa5fe01a388b3a1b3dafa3b2f5f56aa35b0dde5cdab11028b04e33a1e620
-
Filesize
355KB
MD58587c6d37c1e83a6188ce9ff8054ee59
SHA13a4d115929ef9497aa58f91779db3be6ac310321
SHA2567ccaa097ef1d77a7a2c18aefc6814c451ef16849e6ab871bfb7e83216a7f83e0
SHA5123c78e956d6ae674958f3fea7becf38fd5cac9240cb246d0705a6739a6fa43762c85910b0b66896de6723198d710d9a2f6388ac5de37ee800bda9daf3bdaac864
-
Filesize
355KB
MD51dc0d8c266949017b73037cb9ef1e6f6
SHA181724659d310a14067c8a129726d33bbe4a49a97
SHA2560c63b602366c1a3408b7357f551b62d5f662b00a976212862851b626ce53e6f7
SHA512ae14354f4b6f5afbbab8ff486d91e04d3d942564cbdec88ef5d34258bf5d034e3c5b60719bfcd7e3f03ceab3d3d31fc93dae9ce1f6839867f75dd2b975c2cb35
-
Filesize
733KB
MD5391633b47b185c703dd2bb5b471f377d
SHA173a629e8083b10209213152f838372f5e66cc3c1
SHA256d793c06e4d22cc8fb8b88cbc088688813874f7ce9e1be2db6ed11b124e47220e
SHA51235938e9611579ea0a9d0200b915f6e30b7bfa68de0df8cb56ed0d7470c4dd66308b470f68e3c2a00d5bd9ce22cbd43b9e01124459f6214744f116e56dac4f73b
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
1.6MB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
232KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
804KB
-
Filesize
232KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
40KB
-
Filesize
6.9MB
-
Filesize
432KB
-
Filesize
6.9MB
-
Filesize
624KB
-
Filesize
6.8MB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
5.0MB
-
Filesize
804KB