Analysis

  • max time kernel
    145s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    15/03/2025, 09:08

General

  • Target

    zzzz.exe

  • Size

    439KB

  • MD5

    91dfc3dc22ce12c3cb94b2afb29735f9

  • SHA1

    4478a7cca636b5163e24328478f6c654ffc02184

  • SHA256

    66e6eb7cf7be2d2f07adec4d17c143c6a58d56cda382da6ff918ebecc8ee807a

  • SHA512

    6799e99a258f3c65ef511e5faf7f5b843a30f6ae0a8e6112505cf9fc09c12732f8147e8498922d8451af1c5f5a899e55da8ad68a6c6f0555e358d9b9ed9321a9

  • SSDEEP

    12288:VLdcfxaeM6fy/KaVUtgKkTZ73coNRJHwSuBzB0:dkIZGSAtgN+eJHwSuBzB0

Malware Config

Signatures

  • Babylon RAT

    Babylon RAT is remote access trojan written in C++.

  • Babylonrat family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\zzzz.exe
    "C:\Users\Admin\AppData\Local\Temp\zzzz.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\ProgramData\Babylon RAT\client.exe
      "C:\ProgramData\Babylon RAT\client.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\ProgramData\Babylon RAT\client.exe
        "C:\ProgramData\Babylon RAT\client.exe" 2812
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2960

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\Babylon RAT\client.exe

    Filesize

    439KB

    MD5

    91dfc3dc22ce12c3cb94b2afb29735f9

    SHA1

    4478a7cca636b5163e24328478f6c654ffc02184

    SHA256

    66e6eb7cf7be2d2f07adec4d17c143c6a58d56cda382da6ff918ebecc8ee807a

    SHA512

    6799e99a258f3c65ef511e5faf7f5b843a30f6ae0a8e6112505cf9fc09c12732f8147e8498922d8451af1c5f5a899e55da8ad68a6c6f0555e358d9b9ed9321a9

  • memory/2812-9-0x00000000001B0000-0x00000000002A3000-memory.dmp

    Filesize

    972KB

  • memory/2812-13-0x00000000001B0000-0x00000000002A3000-memory.dmp

    Filesize

    972KB

  • memory/2812-14-0x0000000002CE0000-0x0000000002DD3000-memory.dmp

    Filesize

    972KB

  • memory/2812-20-0x00000000001B0000-0x00000000002A3000-memory.dmp

    Filesize

    972KB

  • memory/2812-22-0x00000000001B0000-0x00000000002A3000-memory.dmp

    Filesize

    972KB

  • memory/2916-0-0x0000000000AB0000-0x0000000000BA3000-memory.dmp

    Filesize

    972KB

  • memory/2916-8-0x0000000000AB0000-0x0000000000BA3000-memory.dmp

    Filesize

    972KB

  • memory/2916-6-0x0000000002650000-0x0000000002743000-memory.dmp

    Filesize

    972KB

  • memory/2960-17-0x00000000001B0000-0x00000000002A3000-memory.dmp

    Filesize

    972KB