Analysis
-
max time kernel
30s -
max time network
25s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-12-2024 10:06
General
-
Target
babylonrat.exe
-
Size
733KB
-
MD5
1f491b029221bcbcc52f101effcdcd05
-
SHA1
0df19428a47dc69ff5fbf09ceb89169e8e3261e8
-
SHA256
6307526cdf7d6d87e41f57b43c2231e4a88cd65f974a72078ee247543c24241b
-
SHA512
c43c633a335361001e789cee9eed489a284b9f7f535e45ef2851d9c42dcfbcfb7ac83bac34fa9304643d93fb5edefd480c851294a720b261c98fc3c1b34de6e1
-
SSDEEP
12288:8qzcpVgUXzL0TTUKZHTNloEkOpnKgofuIwV6eAj0wZxxXMcEe/3paPcgxX:8qzcpKIL0TvZzNlNky0wVW0wZxxVgxX
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\babylonrat.exe"C:\Users\Admin\AppData\Local\Temp\babylonrat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx