babadeda | 78751dd14a37b8dd074c9dc6e8fa18693e41ac2d663652e76616188d1f5131dc

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/01/2025, 08:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe
Size 9.4MB
Sample250107-j1egcsskas
SHA256 78751dd14a37b8dd074c9dc6e8fa18693e41ac2d663652e76616188d1f5131dc
MD5 5730f17fceb0f2fdd132677517c03ff0
SHA1 ed9f14f7438d4ad45904bb5721d4f9712f66bdc1
SHA512 7bee65139c270673ed7ca7276acee4df30285943f6d08616b6e3f04e544b0eb7f50d1a9b508b33d20434c24ab6d2ad345b91159bbf69e60b56ad98bb6f1c874f
SSDEEP 196608:26xqZc05LWdl1Z+UwN6E3wmnymNk+tacjMcqY55s/ck:/qZc0mvZ+ScorY55s/ck
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

babadeda bitrat crypter discovery loader trojan

Malware Config

Extracted

Family

bitrat

Version

1.38

185.215.113.102:1234

Attributes

communication_password
5d55208d3d81a0bf50741250fe5b93d7
tor_process
tor

Signatures

Babadeda
Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.
loader crypter babadeda

Babadeda Crypter 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000019c57-363.dat	family_babadeda

Babadeda family
babadeda
BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Bitrat family
bitrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\netoptimize.lnk	unitylocation.exe

Executes dropped EXE 3 IoCs

pid	Process
2332	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp
2152	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp
1364	unitylocation.exe

Loads dropped DLL 7 IoCs

pid	Process
576	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe
3012	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe
2152	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp
2152	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp
1364	unitylocation.exe
1364	unitylocation.exe
1364	unitylocation.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1364	unitylocation.exe
1364	unitylocation.exe
1364	unitylocation.exe
1364	unitylocation.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unitylocation.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2152	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp
2152	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1364	unitylocation.exe
Token: SeShutdownPrivilege	1364	unitylocation.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2152	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1364	unitylocation.exe
1364	unitylocation.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2332	576	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	31
PID 576 wrote to memory of 2332	576	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	31
PID 576 wrote to memory of 2332	576	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	31
PID 576 wrote to memory of 2332	576	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	31
PID 576 wrote to memory of 2332	576	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	31
PID 576 wrote to memory of 2332	576	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	31
PID 576 wrote to memory of 2332	576	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	31
PID 2332 wrote to memory of 3012	2332	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp	32
PID 2332 wrote to memory of 3012	2332	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp	32
PID 2332 wrote to memory of 3012	2332	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp	32
PID 2332 wrote to memory of 3012	2332	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp	32
PID 2332 wrote to memory of 3012	2332	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp	32
PID 2332 wrote to memory of 3012	2332	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp	32
PID 2332 wrote to memory of 3012	2332	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp	32
PID 3012 wrote to memory of 2152	3012	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	33
PID 3012 wrote to memory of 2152	3012	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	33
PID 3012 wrote to memory of 2152	3012	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	33
PID 3012 wrote to memory of 2152	3012	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	33
PID 3012 wrote to memory of 2152	3012	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	33
PID 3012 wrote to memory of 2152	3012	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	33
PID 3012 wrote to memory of 2152	3012	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe	33
PID 2152 wrote to memory of 1364	2152	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp	34
PID 2152 wrote to memory of 1364	2152	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp	34
PID 2152 wrote to memory of 1364	2152	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp	34
PID 2152 wrote to memory of 1364	2152	JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:576
- C:\Users\Admin\AppData\Local\Temp\is-JIF3L.tmp\JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JIF3L.tmp\JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp" /SL5="$5014E,8975360,831488,C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe" /VERYSILENT
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\is-VQU3Q.tmp\JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-VQU3Q.tmp\JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp" /SL5="$6014E,8975360,831488,C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.exe" /VERYSILENT
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\Users\Admin\AppData\Roaming\Unity Service Location\unitylocation.exe
        
        "C:\Users\Admin\AppData\Roaming\Unity Service Location\unitylocation.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JxCnv.dll

Path C:\Users\Admin\AppData\Roaming\Unity Service Location\JxCnv.dll
Size 4.3MB
SHA256 59b183e843e15cc18973bd6b8a9cc184cca5ea62816df1871225f2d3b8a976e0
MD5 99423c8feb458ebed3e27e7ab6737b06
SHA1 a6397b36e09be8aa4393be9b5626e9b3b697fded
SHA512 fecf185dd0682a4887b073b385a99593be6b7f0c712ce6f67a144222e4e17ec3599ad9e122af126a0dbff523a93b729e6f1e2f9864c88aaf1d5c47a0842b1393
SSDEEP 98304:ONkWpZyYksGdLRCLhIocQe7kMakNRaYj:jYZyY5Glgze7kuNRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.xml

Path C:\Users\Admin\AppData\Roaming\Unity Service Location\install.xml
Size 7.7MB
SHA256 ddbfa667a930b15f75a251c4c5372165d62be984d5b10a57599a48df2941ec6c
MD5 ebe3125bd554c1ddbb29fcd9aaaef8b9
SHA1 451d29007db97880b528bac2b94131192f9985e7
SHA512 b5e4e79b342b177370e63ac2b376ac70133e71143ed1e862a4b9edb5f702be126f399bbb30590fe496d4d0a5614984c20bbf7320bf923a001f49cedc024eb221
SSDEEP 98304:FWcpa4SPWB/eX/s+G1VsgTGNPkvS1hvu7KXsZjVhvDTXC:Acpay2Ps+G1VsrNuS1FsZXvC
MD5 SHA1 SHA512 SSDEEP

Submit Download

libmpeg2.dll

Path C:\Users\Admin\AppData\Roaming\Unity Service Location\libmpeg2.dll
Size 1.3MB
SHA256 222176f087acb16b3ba76577abbb718218a384d95bf824449d086e44de10a1d2
MD5 e37b4fa82f6710909438e20522be31a8
SHA1 4e08cbe4389454e7995bd9f0ec7aed82d5ac1a50
SHA512 bf6dc4d9d5425d627c827a1c3d08c3132537232c28404c61b705cadc09d0b0c4db9b9db42b4f899a0662f19f71a9aec2093e759d2f5f1a841acb9d5a3ef309da
SSDEEP 24576:7vPGO1e6xBnWw1VEST8IKH3ql7nbz/jz/zz/Oz/qz/jz/8z/cL/ADDmPdde9OCVh:75eUtXSI0yRKBupMcRc/s+kobXnz/q/3
MD5 SHA1 SHA512 SSDEEP

Submit Download

JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp

Path \Users\Admin\AppData\Local\Temp\is-JIF3L.tmp\JaffaCakes118_5730f17fceb0f2fdd132677517c03ff0.tmp
Size 3.0MB
SHA256 1b57218ca7d377607f000087f4c4e9f9aa5fd307701bfaee25351882db0c71ee
MD5 94a90ed7083275d9e4d95c5835ffef71
SHA1 f5c15de23e9ced6a11d0258d913ff2ae46825af9
SHA512 ad210850e0cd75fcb0309bbb972e695a0fbe84cb9081ad1e5ace907fd3d9d1fff89c492a120e9b1c4dd17cb241be52f0f87f5042439441ac678fa909bae20fa9
SSDEEP 49152:qEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTV+333TY:692bz2Eb6pd7B6bAGx7s333T
MD5 SHA1 SHA512 SSDEEP

Submit Download

unitylocation.exe

Path \Users\Admin\AppData\Roaming\Unity Service Location\unitylocation.exe
Size 7.4MB
SHA256 8c9bef93aa1f6aad346e28864e83a1e5a408d74c0291e96ebd6e9aa3beae45a5
MD5 1ea293f829d821c8b49f99c3a9855c86
SHA1 8a496a13c73a0319be3b8af2dc3a7971523a76ee
SHA512 eb7a275596d52df25b0da25357bef2643890a1290b036258507663280c160fc2b1ecb9679f98991f4ae65f1abad628956d261a7554a0aa2fe4400231d8d19f3b
SSDEEP 98304:NV5itsRPTO/hEsGRVR8T7+z8kYsurxQvQOr8Xgwq:gGRPTEELRqBxQrr8Xgw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/576-0-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/576-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/576-14-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1364-381-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Download

memory/1364-356-0x0000000000290000-0x0000000000C8A000-memory.dmp

Download

memory/1364-371-0x0000000004BE0000-0x0000000004BF0000-memory.dmp

Download

memory/1364-374-0x0000000000290000-0x0000000000C8A000-memory.dmp

Download

memory/1364-378-0x0000000000290000-0x0000000000C8A000-memory.dmp

Download

memory/1364-364-0x0000000000290000-0x0000000000C8A000-memory.dmp

Download

memory/2152-355-0x0000000004910000-0x000000000530A000-memory.dmp

Download

memory/2152-358-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/2152-349-0x0000000003700000-0x0000000003710000-memory.dmp

Download

memory/2332-12-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/2332-9-0x0000000000400000-0x000000000071A000-memory.dmp

Download

memory/3012-360-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/3012-15-0x0000000000400000-0x00000000004D8000-memory.dmp

Download