Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 23:11
Behavioral task
behavioral1
Sample
Babylon RAT.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Babylon RAT.exe
Resource
win10v2004-20240802-en
General
-
Target
Babylon RAT.exe
-
Size
6.7MB
-
MD5
aecdce1d7e2a637d1dcacd2b4580487b
-
SHA1
d5cd12f7a18d6777c9ec8458694aa3a74fd23701
-
SHA256
9157a48c53ca7a4543bac5b771886c87ea407bab6bbb053b50bc22709111d572
-
SHA512
8bb5ad64f1b2e75e47c4671396a713018c74c44e84803887c6b4a200ea85f4c020ccfe15211af3899cdcf9d0f46ef994bfd939e462f61062044874f7a64d7a35
-
SSDEEP
98304:KbldsCQTcsBL54TRRTk3w0ZIWoPzSSosDlh7OLifNLxu2UVaCS2e7Csb6j9cgl36:GnPsHqRwvoPzSSosDlhCKzi9/2BO4T
Malware Config
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2528 2404 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Babylon RAT.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2404 Babylon RAT.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2404 Babylon RAT.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2528 2404 Babylon RAT.exe 30 PID 2404 wrote to memory of 2528 2404 Babylon RAT.exe 30 PID 2404 wrote to memory of 2528 2404 Babylon RAT.exe 30 PID 2404 wrote to memory of 2528 2404 Babylon RAT.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Babylon RAT.exe"C:\Users\Admin\AppData\Local\Temp\Babylon RAT.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 6962⤵
- Program crash
PID:2528
-