Behavioral task
behavioral1
Sample
6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe
Resource
win10v2004-20241007-en
General
-
Target
6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe
-
Size
1.6MB
-
MD5
7d1a15fd3c17ad226b3516bea26d7a94
-
SHA1
1fea1c73332b3708b1eb1f2caf80faff3db47c0a
-
SHA256
6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6
-
SHA512
37602ed7869971f113c9dcf5ecbdd07c5982ea5cfc3bb17bac61f3404f0f00df4fa55a128bc081109a0151ceb53698f19b2c58d6126b30d6f96eebc39c405a78
-
SSDEEP
24576:fMN6PENnBBQXf1UCyfGH32hEFS3qWcI6baD8U2ZuDqk4EB:fM15BBwKjEF3M2A1
Malware Config
Signatures
-
Babbleloader family
-
Detects BabbleLoader Payload 1 IoCs
resource yara_rule sample family_babbleloader -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe
Files
-
6e1ba50818ecda9fad9766a31a94e01ab60a910ab47ba780d3d547af8d4747f6.exe.exe windows:6 windows x64 arch:x64
fe99e7ecdc5c896e52392c8a198886e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
SetStdHandle
GetCommandLineA
GetEnvironmentVariableA
SetEnvironmentVariableA
SetCurrentDirectoryA
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstFileA
FindNextChangeNotification
FindNextFileA
FindVolumeClose
GetDiskFreeSpaceExA
GetFileAttributesA
GetFileAttributesExA
GetFileSize
GetFileSizeEx
GetFullPathNameA
ReadFileEx
SetEndOfFile
SetFileAttributesA
UnlockFileEx
GetCompressedFileSizeA
AreFileApisANSI
GetTempPathA
GetVolumeInformationA
SetFileApisToOEM
HeapCreate
GetQueuedCompletionStatus
SleepEx
GetCurrentProcessId
ExitProcess
GetExitCodeProcess
GetCurrentThread
SetThreadPriority
SetThreadPriorityBoost
GetThreadPriorityBoost
GetThreadPriority
ExitThread
TerminateThread
GetExitCodeThread
ResumeThread
TlsSetValue
SetPriorityClass
GetPriorityClass
GetProcessId
GetProcessHandleCount
SetProcessPriorityBoost
SetThreadIdealProcessor
GetProcessShutdownParameters
GetProcessWorkingSetSize
QueueUserWorkItem
SetInformationJobObject
GetBinaryTypeA
GetProcessIoCounters
SwitchToFiber
ConvertFiberToThread
ConvertThreadToFiber
GetTapeStatus
GetStdHandle
BackupSeek
GetLogicalDriveStringsA
GetStartupInfoA
DefineDosDeviceA
QueryDosDeviceA
CopyFileA
CopyFileExA
MoveFileA
MoveFileWithProgressA
FindFirstVolumeA
FindNextVolumeA
GetVolumeNameForVolumeMountPointA
GetDateFormatA
GetTimeFormatA
GetStringTypeW
IsValidCodePage
CompareStringA
GetLocaleInfoA
GetNumberFormatA
EnumSystemGeoID
GetUserGeoID
ConvertDefaultLocale
SetThreadLocale
GetUserDefaultLangID
GetSystemDefaultLangID
GetSystemDefaultLCID
GetStringTypeExA
GetStringTypeA
GetConsoleCP
GetNumberOfConsoleInputEvents
ReadConsoleInputA
SetConsoleCtrlHandler
FillConsoleOutputAttribute
GenerateConsoleCtrlEvent
FlushConsoleInputBuffer
GetConsoleCursorInfo
SetConsoleCursorInfo
SetConsoleScreenBufferSize
SetConsoleCursorPosition
GetLargestConsoleWindowSize
WriteConsoleOutputCharacterA
ReadConsoleOutputCharacterA
ReadConsoleOutputAttribute
ScrollConsoleScreenBufferA
WriteConsoleOutputA
SetConsoleTitleA
GetNumberOfConsoleMouseButtons
GetConsoleFontSize
GetConsoleWindow
VerLanguageNameA
WriteConsoleW
CloseHandle
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetProcAddress
lstrcmpA
GetModuleHandleA
HeapReAlloc
HeapSize
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
WriteFile
GetModuleFileNameW
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindFirstFileExW
FindNextFileW
GetACP
GetOEMCP
GetCPInfo
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
winspool.drv
WritePrinter
FindClosePrinterChangeNotification
FindNextPrinterChangeNotification
FindFirstPrinterChangeNotification
ScheduleJob
ReadPrinter
AbortPrinter
advapi32
DecryptFileA
GetUserNameA
dxgi
CreateDXGIFactory
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ