babylonrat | 0380f882f1526c5f97af909cca3bc066671ffab1e58af34d0cf0148e4c60d92c

General

Target

2025-04-18_aff872071f0803ed231eec8c92ee0592_black-basta_cobalt-strike_satacom.exe
Size

1.5MB
MD5

aff872071f0803ed231eec8c92ee0592
SHA1

dca552c0363ecb14b591e5263ec66073830f2894
SHA256

0380f882f1526c5f97af909cca3bc066671ffab1e58af34d0cf0148e4c60d92c
SHA512

40afe4749470dcaed18a7b30b35706301156745050f0bb6ea05d867af9de7be720f1b0f9aa923b1a9f4cec66bb2bdddaafb89045d33ed1d83829538c9ec5ecf3
SSDEEP

24576:NHHiWcxasI5H1z0ZxMMk5sbviePA+Q8jNy2gMZ4STyPwncCsYeeNrbT:NHHiXasI70Z85UHQX2rZ43P2RsYl

Score

10^/10

babylonrat discovery execution trojan

Malware Config

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat
Babylonrat family
babylonrat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2744	powershell.exe
2744	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4896	000001080029.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000001080029.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2744	powershell.exe
2744	powershell.exe
2700	2025-04-18_aff872071f0803ed231eec8c92ee0592_black-basta_cobalt-strike_satacom.exe
2700	2025-04-18_aff872071f0803ed231eec8c92ee0592_black-basta_cobalt-strike_satacom.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4896	000001080029.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeShutdownPrivilege	4896	000001080029.exe
Token: SeDebugPrivilege	4896	000001080029.exe
Token: SeTcbPrivilege	4896	000001080029.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4896	000001080029.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2744	2700	2025-04-18_aff872071f0803ed231eec8c92ee0592_black-basta_cobalt-strike_satacom.exe	80
PID 2700 wrote to memory of 2744	2700	2025-04-18_aff872071f0803ed231eec8c92ee0592_black-basta_cobalt-strike_satacom.exe	80
PID 2700 wrote to memory of 4896	2700	2025-04-18_aff872071f0803ed231eec8c92ee0592_black-basta_cobalt-strike_satacom.exe	82
PID 2700 wrote to memory of 4896	2700	2025-04-18_aff872071f0803ed231eec8c92ee0592_black-basta_cobalt-strike_satacom.exe	82
PID 2700 wrote to memory of 4896	2700	2025-04-18_aff872071f0803ed231eec8c92ee0592_black-basta_cobalt-strike_satacom.exe	82

C:\Users\Admin\AppData\Local\Temp\2025-04-18_aff872071f0803ed231eec8c92ee0592_black-basta_cobalt-strike_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-18_aff872071f0803ed231eec8c92ee0592_black-basta_cobalt-strike_satacom.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Documents\App'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2744
- C:\Users\Admin\Documents\App\000001080029.exe
  "C:\Users\Admin\Documents\App\000001080029.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dofuowqa.1u3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Documents\App\000001080029.exe

Filesize
777KB

MD5
31b9cb0b82e116f9151fa9366704e3ac

SHA1
f35861c5e3339ac72dfda6e1871f2ce1ac22d940

SHA256
3348268bf5c64541bd18971ffcd0f54b7ff2c31ddafe368777929e6e3bf8347d

SHA512
8f72eb6a5096d340f8ca3dbdc7efac8690aa39f5341ee46da9145fc3e989b7eb176ec846bcd2124c2fab6f3713d868c0d71cd766b50876a9846c333a65818963

Download Submit
memory/2744-0-0x00007FFA355F3000-0x00007FFA355F5000-memory.dmp

Filesize
8KB

Download
memory/2744-9-0x00000242231D0000-0x00000242231F2000-memory.dmp

Filesize
136KB

Download
memory/2744-10-0x00007FFA355F0000-0x00007FFA360B2000-memory.dmp

Filesize
10.8MB

Download
memory/2744-11-0x00007FFA355F0000-0x00007FFA360B2000-memory.dmp

Filesize
10.8MB

Download
memory/2744-12-0x00007FFA355F0000-0x00007FFA360B2000-memory.dmp

Filesize
10.8MB

Download
memory/2744-13-0x00007FFA355F0000-0x00007FFA360B2000-memory.dmp

Filesize
10.8MB

Download
memory/2744-16-0x00007FFA355F0000-0x00007FFA360B2000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing