Analysis
-
max time kernel
145s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
15/03/2025, 09:08
Behavioral task
behavioral1
Sample
zzzz.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
zzzz.exe
Resource
win10v2004-20250314-en
General
-
Target
zzzz.exe
-
Size
439KB
-
MD5
91dfc3dc22ce12c3cb94b2afb29735f9
-
SHA1
4478a7cca636b5163e24328478f6c654ffc02184
-
SHA256
66e6eb7cf7be2d2f07adec4d17c143c6a58d56cda382da6ff918ebecc8ee807a
-
SHA512
6799e99a258f3c65ef511e5faf7f5b843a30f6ae0a8e6112505cf9fc09c12732f8147e8498922d8451af1c5f5a899e55da8ad68a6c6f0555e358d9b9ed9321a9
-
SSDEEP
12288:VLdcfxaeM6fy/KaVUtgKkTZ73coNRJHwSuBzB0:dkIZGSAtgN+eJHwSuBzB0
Malware Config
Signatures
-
Babylon RAT
Babylon RAT is remote access trojan written in C++.
-
Babylonrat family
-
Executes dropped EXE 2 IoCs
pid Process 2812 client.exe 2960 client.exe -
Loads dropped DLL 2 IoCs
pid Process 2916 zzzz.exe 2812 client.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Babylon RAT = "C:\\ProgramData\\Babylon RAT\\client.exe" zzzz.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Babylon RAT = "C:\\ProgramData\\Babylon RAT\\client.exe" client.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Babylon RAT = "C:\\ProgramData\\Babylon RAT\\client.exe" client.exe -
resource yara_rule behavioral1/memory/2916-0-0x0000000000AB0000-0x0000000000BA3000-memory.dmp upx behavioral1/files/0x0008000000015d41-2.dat upx behavioral1/memory/2812-9-0x00000000001B0000-0x00000000002A3000-memory.dmp upx behavioral1/memory/2916-8-0x0000000000AB0000-0x0000000000BA3000-memory.dmp upx behavioral1/memory/2916-6-0x0000000002650000-0x0000000002743000-memory.dmp upx behavioral1/memory/2812-13-0x00000000001B0000-0x00000000002A3000-memory.dmp upx behavioral1/memory/2960-17-0x00000000001B0000-0x00000000002A3000-memory.dmp upx behavioral1/memory/2812-20-0x00000000001B0000-0x00000000002A3000-memory.dmp upx behavioral1/memory/2812-22-0x00000000001B0000-0x00000000002A3000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zzzz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2812 client.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeShutdownPrivilege 2916 zzzz.exe Token: SeDebugPrivilege 2916 zzzz.exe Token: SeTcbPrivilege 2916 zzzz.exe Token: SeShutdownPrivilege 2812 client.exe Token: SeDebugPrivilege 2812 client.exe Token: SeTcbPrivilege 2812 client.exe Token: SeShutdownPrivilege 2960 client.exe Token: SeDebugPrivilege 2960 client.exe Token: SeTcbPrivilege 2960 client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2812 client.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2812 2916 zzzz.exe 30 PID 2916 wrote to memory of 2812 2916 zzzz.exe 30 PID 2916 wrote to memory of 2812 2916 zzzz.exe 30 PID 2916 wrote to memory of 2812 2916 zzzz.exe 30 PID 2812 wrote to memory of 2960 2812 client.exe 31 PID 2812 wrote to memory of 2960 2812 client.exe 31 PID 2812 wrote to memory of 2960 2812 client.exe 31 PID 2812 wrote to memory of 2960 2812 client.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\zzzz.exe"C:\Users\Admin\AppData\Local\Temp\zzzz.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\ProgramData\Babylon RAT\client.exe"C:\ProgramData\Babylon RAT\client.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\ProgramData\Babylon RAT\client.exe"C:\ProgramData\Babylon RAT\client.exe" 28123⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
439KB
MD591dfc3dc22ce12c3cb94b2afb29735f9
SHA14478a7cca636b5163e24328478f6c654ffc02184
SHA25666e6eb7cf7be2d2f07adec4d17c143c6a58d56cda382da6ff918ebecc8ee807a
SHA5126799e99a258f3c65ef511e5faf7f5b843a30f6ae0a8e6112505cf9fc09c12732f8147e8498922d8451af1c5f5a899e55da8ad68a6c6f0555e358d9b9ed9321a9