Overview

overview

10

Static

static

10

Babylon RA...AT.exe

windows7-x64

10

Babylon RA...AT.exe

windows10-2004-x64

10

Babylon RA...ew.dll

windows7-x64

1

Babylon RA...ew.dll

windows10-2004-x64

1

Babylon RA...GI.dll

windows7-x64

1

Babylon RA...GI.dll

windows10-2004-x64

1

Babylon RA...D1.dll

windows7-x64

1

Babylon RA...D1.dll

windows10-2004-x64

1

Babylon RA...10.dll

windows7-x64

1

Babylon RA...10.dll

windows10-2004-x64

1

Babylon RA...DX.dll

windows7-x64

1

Babylon RA...DX.dll

windows10-2004-x64

1

Babylon RAT/Theme.dll

windows7-x64

1

Babylon RAT/Theme.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-08-2024 05:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Babylon RAT/Babylon RAT.exe

  • Size

    6.7MB

  • MD5

    aecdce1d7e2a637d1dcacd2b4580487b

  • SHA1

    d5cd12f7a18d6777c9ec8458694aa3a74fd23701

  • SHA256

    9157a48c53ca7a4543bac5b771886c87ea407bab6bbb053b50bc22709111d572

  • SHA512

    8bb5ad64f1b2e75e47c4671396a713018c74c44e84803887c6b4a200ea85f4c020ccfe15211af3899cdcf9d0f46ef994bfd939e462f61062044874f7a64d7a35

  • SSDEEP

    98304:KbldsCQTcsBL54TRRTk3w0ZIWoPzSSosDlh7OLifNLxu2UVaCS2e7Csb6j9cgl36:GnPsHqRwvoPzSSosDlhCKzi9/2BO4T

Score
10/10
babylonratcredential_accessdiscoverypersistencespywarestealertrojanupx

Malware Config

Signatures

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

    trojanbabylonrat
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 57 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Babylon RAT\Babylon RAT.exe
    "C:\Users\Admin\AppData\Local\Temp\Babylon RAT\Babylon RAT.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2260
    • C:\Users\Admin\AppData\Local\Temp\Babylon RAT\upx.exe
      "C:\Users\Admin\AppData\Local\Temp\Babylon RAT\upx.exe" "C:\Users\Admin\Downloads\water.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4316
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4580
    • C:\Users\Admin\Downloads\water.exe
      "C:\Users\Admin\Downloads\water.exe"
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1012
      • C:\ProgramData\Babylon RAT\client.exe
        "C:\ProgramData\Babylon RAT\client.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:5036

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Babylon RAT\upx.exe
      Filesize

      298KB

      MD5

      e9eacbb7ab4b3f66019e0a2f13a1dba9

      SHA1

      ae30894b29e52bf04afc4a54795d438fb910acff

      SHA256

      0c3dc789d0a46493bd097526b920d913d930d96b1052cb331eec3ac560c89996

      SHA512

      925445d20c93c65a282fc59f773551d824bff1f8e2623fd8ea0c587831a9550c400f121defb3d82c8f0401903fa69e3154dc98e29688d02af1d5d01247914a06

      Download Submit

    • C:\Users\Admin\Downloads\water.exe
      Filesize

      733KB

      MD5

      0699639eb35c45d41e85ac09f218111e

      SHA1

      6c6656c302d3d9df2aaa29a70801939e7452c87a

      SHA256

      1ffb6cf435f9ff6612f7f52e83f90a83056e3e4560bfc153cc18b38dfdbaafc9

      SHA512

      e42e78fcc06ca292d904aba03e618ae4ff7a3cca718e6703696fb5ff116ea8feef6ca7a0c0725f286e5c724ba61ba871b02a54ef397a89ee749917ed78a72c23

      Download Submit

    • C:\Users\Admin\Downloads\water.exe
      Filesize

      355KB

      MD5

      89271d9f2ef2867fbcbd4fab26525de4

      SHA1

      b4de7b9f4691e3d41918c5ac5e29133f57f46eb8

      SHA256

      49f807b2d53b396c02a146e7ed175ea8efedb675f274f26e75b470b249702a25

      SHA512

      2d434cdfdf4162126269a26ef2bb3cc7e693134f266b4a1c8a37799a61e919492b0c878e84bd65da78445de0891a4c3c3a5a6b6413fae97e27ba008c6b02fe19

      Download Submit

    • memory/1012-45-0x00000000003A0000-0x0000000000469000-memory.dmp

      Filesize

      804KB

      Download

    • memory/1012-38-0x00000000003A0000-0x0000000000469000-memory.dmp

      Filesize

      804KB

      Download

    • memory/2260-12-0x0000000074D70000-0x0000000075520000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2260-0-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2260-7-0x0000000008C80000-0x0000000008CEC000-memory.dmp

      Filesize

      432KB

      Download

    • memory/2260-8-0x000000000A8F0000-0x000000000A98C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/2260-9-0x0000000074D70000-0x0000000075520000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2260-10-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2260-11-0x0000000074D70000-0x0000000075520000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2260-2-0x00000000085D0000-0x0000000008B74000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/2260-13-0x0000000074D70000-0x0000000075520000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2260-14-0x0000000074D70000-0x0000000075520000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2260-5-0x0000000005640000-0x000000000564A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2260-6-0x0000000008080000-0x000000000809E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/2260-4-0x0000000074D70000-0x0000000075520000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2260-1-0x0000000000B00000-0x00000000011C2000-memory.dmp

      Filesize

      6.8MB

      Download

    • memory/2260-3-0x00000000080C0000-0x0000000008152000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4316-27-0x0000000000400000-0x000000000059C000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/4316-35-0x0000000000400000-0x000000000059C000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/5036-43-0x0000000000BF0000-0x0000000000CB9000-memory.dmp

      Filesize

      804KB

      Download

    • memory/5036-46-0x000000006E830000-0x000000006E869000-memory.dmp

      Filesize

      228KB

      Download

    • memory/5036-48-0x0000000000BF0000-0x0000000000CB9000-memory.dmp

      Filesize

      804KB

      Download

    • memory/5036-50-0x0000000000BF0000-0x0000000000CB9000-memory.dmp

      Filesize

      804KB

      Download