Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2024 09:22
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe
-
Size
1.3MB
-
MD5
b04423f83519155fc950f822e03689c0
-
SHA1
3a32f770c2d28954c10a2facba5ca2f1ba5c4cfc
-
SHA256
06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77
-
SHA512
60445ebd75651d2f3914c8352de0195a03ea0c31dab9bb140d441623804c75eadbe5ad4b8ffaf5c8f30cdcf8d2638ca3fafae932b77bd64c03822b16febc8fd7
-
SSDEEP
24576:PAHnh+eWsN3skA4RV1Hom2KXMmHaOg6ca9Jxys5csIBtnr0R5:yh+ZkldoPK8YaOfcixysesIDa
Score
10/10
Malware Config
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
Babylonrat family
-
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1692 set thread context of 2828 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 96 PID 1692 set thread context of 1292 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 97 PID 1692 set thread context of 4456 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 98 PID 1692 set thread context of 1096 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 100 PID 1692 set thread context of 4716 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 101 PID 1692 set thread context of 2384 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 102 -
resource yara_rule behavioral2/memory/2828-0-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/2828-2-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/1292-9-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/1292-10-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/2828-19-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/2828-17-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4456-16-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/2828-11-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/2828-7-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/2828-5-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/2828-29-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/2828-31-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/2828-32-0x0000000000400000-0x00000000004C9000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Notepad.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2828 Notepad.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 2828 Notepad.exe Token: SeDebugPrivilege 2828 Notepad.exe Token: SeTcbPrivilege 2828 Notepad.exe Token: SeShutdownPrivilege 1292 Notepad.exe Token: SeDebugPrivilege 1292 Notepad.exe Token: SeTcbPrivilege 1292 Notepad.exe Token: SeShutdownPrivilege 4456 Notepad.exe Token: SeDebugPrivilege 4456 Notepad.exe Token: SeTcbPrivilege 4456 Notepad.exe Token: SeShutdownPrivilege 1096 Notepad.exe Token: SeDebugPrivilege 1096 Notepad.exe Token: SeTcbPrivilege 1096 Notepad.exe Token: SeShutdownPrivilege 4716 Notepad.exe Token: SeDebugPrivilege 4716 Notepad.exe Token: SeTcbPrivilege 4716 Notepad.exe Token: SeShutdownPrivilege 2384 Notepad.exe Token: SeDebugPrivilege 2384 Notepad.exe Token: SeTcbPrivilege 2384 Notepad.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2828 Notepad.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2828 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 96 PID 1692 wrote to memory of 2828 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 96 PID 1692 wrote to memory of 2828 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 96 PID 1692 wrote to memory of 2828 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 96 PID 1692 wrote to memory of 2828 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 96 PID 1692 wrote to memory of 2828 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 96 PID 1692 wrote to memory of 2828 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 96 PID 1692 wrote to memory of 2828 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 96 PID 1692 wrote to memory of 1292 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 97 PID 1692 wrote to memory of 1292 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 97 PID 1692 wrote to memory of 1292 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 97 PID 1692 wrote to memory of 1292 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 97 PID 1692 wrote to memory of 1292 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 97 PID 1692 wrote to memory of 1292 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 97 PID 1692 wrote to memory of 1292 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 97 PID 1692 wrote to memory of 1292 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 97 PID 1692 wrote to memory of 4456 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 98 PID 1692 wrote to memory of 4456 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 98 PID 1692 wrote to memory of 4456 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 98 PID 1692 wrote to memory of 4456 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 98 PID 1692 wrote to memory of 4456 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 98 PID 1692 wrote to memory of 4456 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 98 PID 1692 wrote to memory of 4456 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 98 PID 1692 wrote to memory of 4456 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 98 PID 1692 wrote to memory of 1096 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 100 PID 1692 wrote to memory of 1096 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 100 PID 1692 wrote to memory of 1096 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 100 PID 1692 wrote to memory of 1096 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 100 PID 1692 wrote to memory of 1096 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 100 PID 1692 wrote to memory of 1096 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 100 PID 1692 wrote to memory of 1096 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 100 PID 1692 wrote to memory of 1096 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 100 PID 1692 wrote to memory of 4716 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 101 PID 1692 wrote to memory of 4716 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 101 PID 1692 wrote to memory of 4716 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 101 PID 1692 wrote to memory of 4716 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 101 PID 1692 wrote to memory of 4716 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 101 PID 1692 wrote to memory of 4716 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 101 PID 1692 wrote to memory of 4716 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 101 PID 1692 wrote to memory of 4716 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 101 PID 1692 wrote to memory of 2384 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 102 PID 1692 wrote to memory of 2384 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 102 PID 1692 wrote to memory of 2384 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 102 PID 1692 wrote to memory of 2384 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 102 PID 1692 wrote to memory of 2384 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 102 PID 1692 wrote to memory of 2384 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 102 PID 1692 wrote to memory of 2384 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 102 PID 1692 wrote to memory of 2384 1692 06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe"C:\Users\Admin\AppData\Local\Temp\06cee330873dcfa28588c5cedcb0caf23ac9a5a1e5b80ba4d6b9814228a77b77N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\Notepad.exe"C:\Windows\SysWOW64\Notepad.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2828
-
-
C:\Windows\SysWOW64\Notepad.exe"C:\Windows\SysWOW64\Notepad.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
C:\Windows\SysWOW64\Notepad.exe"C:\Windows\SysWOW64\Notepad.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
C:\Windows\SysWOW64\Notepad.exe"C:\Windows\SysWOW64\Notepad.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
-
C:\Windows\SysWOW64\Notepad.exe"C:\Windows\SysWOW64\Notepad.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
-
C:\Windows\SysWOW64\Notepad.exe"C:\Windows\SysWOW64\Notepad.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2384
-