Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/01/2025, 22:08

General

  • Target

    $PLUGINSDIR/bundle.exe

  • Size

    842KB

  • MD5

    d4fe9619462d7613a6750256c94f4589

  • SHA1

    eb6aa6e142a33cee2c2b47c3c201bdf6b28fa846

  • SHA256

    38615621239677224d4ff592dc91df1164d700be52a346e81df91f37a648b91c

  • SHA512

    ef9fd81eb3deb85cf8c4325039a4b2a9bb286069ad4510403d96c3784a0d71a14a2b729ba0667d3c4bddddfa8b926d25cd25f128133d26928d1912c15905c7b8

  • SSDEEP

    12288:oR+F3vu5WAEhqkiVQfu1Cx+L8IGWRlNFhnbDZ7QjRpRXACco3OB:LF3h8jQ/AG0llRkjR9PS

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bundle.exe
    "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bundle.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\Setup.exe" Files\Common Files
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5092
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\\rundll32.exe C:\Users\Admin\AppData\Local\Temp\3FF06B~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache URI|http://babylon.com
        3⤵
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        PID:2904

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\BExternal.dll

          Filesize

          126KB

          MD5

          5fb8613b7cf68604bb7a1bf2bbcf048d

          SHA1

          2688ca41771cc9c5b318c60b8e4dac94d479b00b

          SHA256

          ce2ffd4eb568f61623a1b94a5c8958140b328b09504aaeebf98c9a8c56ab65ec

          SHA512

          06fb08f8b54740eaa8b691c39397611f634306e165cc3cf2217d7dd3df038b4f08cdd0852f87dc93984d5f5bea61f5123f896d9634809492da1fe92f0747dd47

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\Babylon.dat

          Filesize

          12KB

          MD5

          adbb6a655ae518830ba1afefdb84668f

          SHA1

          a1be53d99a67fff011ea035c310588e635c718e1

          SHA256

          7029ed42440ab0b23c76c2800871002151776f927cc77855590e79b31b96838c

          SHA512

          b5ddfa301fdcd852a35c6b8a5d4eed78c43bc250d7e2c7d95b548d5f5ce216f2b9f5eabf5e1c0c87691d735fc1ac7a33a5c236c5560a4777ef7bf75510f0b228

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\blueStar.png

          Filesize

          14KB

          MD5

          a7fcdf142648bac756fcfe06a31f42e4

          SHA1

          4df99b119c183c821ed1bf0f825536318c9c3353

          SHA256

          008aebc73a7bd79e914db753b83a385c1aac320ebbcf4ead8fa49f74e3f30f22

          SHA512

          ddd8571b02909ede720af8e27044e126002a749719f41fe65d44004a5165ebfd90e5cca007e6014194de510a0076862839ecd056bf0043113337ab25086037eb

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\eula.html

          Filesize

          79KB

          MD5

          1b73a781f7f5b0d61624bd97050a2ed0

          SHA1

          01b848625761d5dede115e8599e4c72f126f8a3c

          SHA256

          f7f4148b58242a889a8694d734e49ca96bdad63d7fa5d5be130acfa9414b5cb5

          SHA512

          76eb4cd01eae14b0050802ad4cd0e401e2e65705d4d4b8c25e3632bd24745ec85df129c51332500823953755314a51907f0a713d0c2011054490acebc9c2787f

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\globe.png

          Filesize

          33KB

          MD5

          cc53fb9e9456eb79479151090cb16cbd

          SHA1

          e61004bf729757f3f225f77f0236b82518f68662

          SHA256

          3eca21891a2b484a38098410c5d8410361e91ae4dd84cb565891281145501f42

          SHA512

          0aac27727044ef9cf05e7a8d35d4395c9812a9169fd1661f95f53a2d809a7a73a034058b8080529ab50471688877cfdb45a282308ef86eb4812a2d734e02d28b

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\options.js

          Filesize

          119B

          MD5

          771f230f8bbc96a03b13976667918f1f

          SHA1

          0fba422c76b89cdb5d12e657064c49a9b1b7abae

          SHA256

          92db8b549583a5498689a42840a282f33d734c3cb081ac6f896377e56d043252

          SHA512

          b8209b679f30fea49ea34b77b7f4126acef962a17b292cbab711660c7ec23646bab91e66ce49fde6570ee3c053bb6b8d521b6917cb16f3e925ce8f82d7b4c8f4

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\pBar.gif

          Filesize

          3KB

          MD5

          26621cb27bbc94f6bab3561791ac013b

          SHA1

          4010a489350cf59fd8f36f8e59b53e724c49cc5b

          SHA256

          e512d5b772fef448f724767662e3a6374230157e35cab6f4226496acc7aa7ad3

          SHA512

          9a19e8f233113519b22d9f3b205f2a3c1b59669a0431a5c3ef6d7ed66882b93c8582f3baa13df4647bcc265d19f7c6543758623044315105479d2533b11f92c6

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\page0.html

          Filesize

          1KB

          MD5

          cf33120dd42cee842d96532843bb1961

          SHA1

          1db4f3e0aa1e4036a078a05f48fefdbb8744e3cf

          SHA256

          783a0e39d4a751462e26e4acfcf6fb4953f818980ad3d7d7fb821ac35c00c29f

          SHA512

          889d4043672b551a08979054add55bca4c5a4438fef5189b1ecf309c803ff1468664ed1123b0d22ceecb21a7bc5cfbf85a7428ed72ad7be04596185432aa68e3

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\page2.css

          Filesize

          2KB

          MD5

          085cf46c4d1c8dea9edd79ee37d6d5bd

          SHA1

          30cb66994c45261a4aaa6d9ecdf1b1890ed09b45

          SHA256

          9ca3bd0f0c3ac1533fcda2e20e2fb3c18deb40986b37ae6edff594becb82405d

          SHA512

          66ea917206a7e771e48e3734004e6b96619c5534cca35c2e59e7c2922bec7dca5fbb6536e8940013871becce7493b0e2b1844cc5f37668396639c6d7c7e321a9

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\page2.html

          Filesize

          3KB

          MD5

          12152ded3604e8baaf82c078f8034d60

          SHA1

          0867dec241a257e3e9ad9e8d20b9e06e3bce7184

          SHA256

          abb8953ffc3818e54e86019e1920595d65ba0997f3fd7fd47480a450cd7ee485

          SHA512

          a38ed7d7ef0be98ef362b4f5345961ac56f2db9e184b8a405dd3b09611796fda2189837a3bc0c27152276225a2fd4c8bfe8324c70df0d67b9cc826212448e79b

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\page2Lrg.css

          Filesize

          1KB

          MD5

          db15b568f9d195635b3fcab87ef6293f

          SHA1

          6ae0f374531cb3013857880e8469a103492b8393

          SHA256

          5d7bd6b3acb31788f12475528d51d98778f1dbc940b2d6dc6317704d17d0964d

          SHA512

          a8d2baf03d85e31847b21ee5c193d11e2f7ccd9ed7630feab3c8e4fe780bc62d1847ff4608654b3201fa6c39175c7d6e650163d9347db40454935856af3f7af7

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\page3.css

          Filesize

          1KB

          MD5

          07784ad77f30fa018949e412b2257aab

          SHA1

          8595c222a3741bfa83c5a4d982c845c8038062a6

          SHA256

          226a67f6e05fd889f91253158e583c443cbc7c27d29e8b441925849f820565cf

          SHA512

          2fe022c30d9280f224ca159edf485ca7ba870bd32b7fb82ee86b3657cdd2e9bdf52525408566ec3ecff80660390f8fac8f04b166623082c706213597f1178cf8

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\page3.html

          Filesize

          1KB

          MD5

          b23c25988099403433efb7fb64715676

          SHA1

          e833527e1c021b311286e6e2d1c2f0530be0a565

          SHA256

          7f2252432fff22505b6fbcce5077a9f455006f724dfa705fbc0540325a14c28c

          SHA512

          8f721e25e47fc5508a0ae1d887a556c22b64b9eb4d2a7ad019b0ddbe4c91649ca52c4582e3cf99338f4b779bd50832110054c46e9bf9f2ffc9a4469343f6838f

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\page3Lrg.css

          Filesize

          977B

          MD5

          b3520c555c46a7020d8f27bfe81df0ca

          SHA1

          59398086abe3987c2a91edacb74eca94bbd63d7d

          SHA256

          74a9e635dc555a07820a288d0dfe05adea386292757f4cd6933ba3ce6697bef6

          SHA512

          0b3243cd84b44be79cc7d45a1e18d9840cb393aaf0b82229a0e5a4378d4588c1d65f1ba80530fa10659777fa6ca7b45785fe4fd4aff8dc6047956f93299c5ca5

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\progress.png

          Filesize

          2KB

          MD5

          dee08d8cbcdeb8013adf28ecf150aaf3

          SHA1

          c61cd9b1bd0127244b9d311f493fc514aa5c08d6

          SHA256

          eb7dbbb4b7f4020a91f5b64084fb3ce08aeac2f72be66959332041ed06b59bf5

          SHA512

          c7ff9e00e5afd3b14947006127c912a3c0e7e7fbdde558f5575e6499deb27eb39199206497bfa4372ce469a0fac64df03ec165c0565a619774531c7311d3223f

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\setup.js

          Filesize

          13KB

          MD5

          a95607ce49fa0af8ed7a3f5667c3eb31

          SHA1

          5e4b5a30e56c42329afdf216625bf35be69a82aa

          SHA256

          01d6d025c169e9c36600d097749f76f8e877846cd8733b7dd958aaea7c54884c

          SHA512

          1f1fe95c04964de2f3fd73a7ba1632fecaf1c9ec80f918859eb91702e10333f1ba0342a85d1129ddb48cbc3ab74a5dcf92f8c4c053f683ecdbf34dee0112015b

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\title.png

          Filesize

          25KB

          MD5

          12ef76069cc40b8ad478d9091915ded6

          SHA1

          fabad560b6e6839f9e5ae1268695d11ca35f9d74

          SHA256

          4be568ed2044e1b74bc1d61d13ce71080e5a9717ed481616a6efc1ec4c35dd0c

          SHA512

          5625082a87aa75266c9680a4f4b31eb7b1df084bba6c7e2e70512f232556f9029af06a0a63b342ffc220bf3797cc09f333437fe26547ea6494913f1c59b2e067

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\HtmlScreens\toolBar.jpg

          Filesize

          19KB

          MD5

          56dc3cb42b46309e642c15167003685d

          SHA1

          045749de2c1492e5dfc4c44f9eb6c0feefe06b3d

          SHA256

          bc488502223b3369dd657e8bac70abc42ffde2223a0661fb507c8ec87778bca1

          SHA512

          5f3dc868d6e128407e071d6d7d7b9d0bbe7e45a32ff76985dfa53fe9dad0f5fb372ce64d35170c3719a06dd6762e4bb33089bfaedf93e6064c06c74a21b65a60

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\IECookieLow.dll

          Filesize

          5KB

          MD5

          a7a1efbbf7a8968223d7e49b60625e30

          SHA1

          1b2801dd02e9d9b7f27789ed161bc1761943e921

          SHA256

          1f008544618eab320dc36467887a60283c7d13bd08dc7ca85c9c06869a353373

          SHA512

          0eba055bf6835b81621065a0dae7e05258405c6f75f5d61ceca4d30862a43682b368a5dce6cd53d86c0ffd6a8c6bd19f0943af71530a48f734d50d8473794f27

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\Setup.exe

          Filesize

          1.7MB

          MD5

          3eff4d0a2dde24e5afe250ba50887f2c

          SHA1

          9adb9ea752959e6945d58068cbc55fa04662d8af

          SHA256

          3cf6717e6bad2e669f96dcd498e79981d2755fbb841e91533f73efa1ffae26cb

          SHA512

          f7c7fe13849a64e5281d94597d2d150d4db171a4070192e08192aee927e3a51786008fc24ef3de3b3ff3f4c5fe86d6b037602300f9c50b7fd9783c3a32cbb7c4

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\SetupStrings.dat

          Filesize

          63KB

          MD5

          07bb1523dc51ec1fd5913b0a70ab98ee

          SHA1

          216f853cb251f32f5c91345404efd48f041ad5bd

          SHA256

          31fdb44bc58ee37f01712c2e9b5f0f7c29058a6cd7f869df2f0ee6d77a552dc2

          SHA512

          8ae9b6ca8a6e6f9692161422b5815944a7ef6e74ff51dbfd9a0dee83828b1140ce399fc40765313e6d2657603731bdd1c791b56df07fe42fb2d152b584d922db

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\bab033.tbinst.dat

          Filesize

          236B

          MD5

          1ee8c638e49ee7137607722768afc5a2

          SHA1

          8719d7a498a49b042cd6fc411cac6c44f3c0f43a

          SHA256

          1368324e8df1654fb9c3bcae320e982ff9f40e76e0cc118d5f507649e1ec2f2e

          SHA512

          2acb5547bb9b62505a5332e3b2752c5004fee9579bc45c46271e53d42fff5f412f3a18863ed382052d961d33d0e0449d9c111950060663660d7dbb21e9bff575

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\bab091.norecovericon.dat

          Filesize

          174B

          MD5

          4f6e1fdbef102cdbd379fdac550b9f48

          SHA1

          5da6ee5b88a4040c80e5269e0cd2b0880b20659c

          SHA256

          e58ea352c050e6353fb5b4fa32a97800298c1603489d3b47794509af6c89ec4c

          SHA512

          54efc9bde44f332932a97396e59eca5b6ea1ac72f929ccffa1bdab96dc3ae8d61e126adbd26d12d0bc83141cee03b24ad2bada411230c4708b7a9ae9c60aecbe

        • C:\Users\Admin\AppData\Local\Temp\3FF06B0B-BAB0-7891-9208-68AD6B64F5D0\sqlite3.dll

          Filesize

          508KB

          MD5

          0f66e8e2340569fb17e774dac2010e31

          SHA1

          406bb6854e7384ff77c0b847bf2f24f3315874a3

          SHA256

          de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f

          SHA512

          39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05

        • memory/5092-100-0x0000000060900000-0x0000000060970000-memory.dmp

          Filesize

          448KB