Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 03:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BabkaLoader-1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
BabkaLoader-1.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target BabkaLoader-1.exe
- Size 6.2MB
- Sample260905-d4ba8abf77
- SHA256 5ade59dbcd352958ea5a7685811f973f6196e180bb62fad4f62a560795d245b9
- MD5 703643f3ce6506cc3b38752646505129
- SHA1 a469fa08d605783f2ec6ab45d6ed567cdf055d8a
- SHA512 273149f2262bfe2fbbac6c9473765357b5d5ba82bf973bf432e63de62367fa8a45ebfc422f00941fa1d5708e9d887cade8f4fb9745d2bb2916017b03234ac902
- SSDEEP 49152:pyr5J/svpKxE6d7jxSXDk7UdcySmJ567WATgXeofclHoUIfZl2BDJZo7h51ij4BC:S5J/O0bd0XoIdcyPJM7Ceb1DexiMEV
- TLSH T183664A02FE8BA4F5E907093151A7727F27345D068B35CBDBEB407B6AF8B76919832205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 5 discord.com 1 discord.com - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 8 api.ipify.org - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BabkaLoader-1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 BabkaLoader-1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 BabkaLoader-1.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 BabkaLoader-1.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2868 wmic.exe 2868 wmic.exe 2868 wmic.exe 2868 wmic.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2868 wmic.exe Token: SeSecurityPrivilege 2868 wmic.exe Token: SeTakeOwnershipPrivilege 2868 wmic.exe Token: SeLoadDriverPrivilege 2868 wmic.exe Token: SeSystemProfilePrivilege 2868 wmic.exe Token: SeSystemtimePrivilege 2868 wmic.exe Token: SeProfSingleProcessPrivilege 2868 wmic.exe Token: SeIncBasePriorityPrivilege 2868 wmic.exe Token: SeCreatePagefilePrivilege 2868 wmic.exe Token: SeBackupPrivilege 2868 wmic.exe Token: SeRestorePrivilege 2868 wmic.exe Token: SeShutdownPrivilege 2868 wmic.exe Token: SeDebugPrivilege 2868 wmic.exe Token: SeSystemEnvironmentPrivilege 2868 wmic.exe Token: SeRemoteShutdownPrivilege 2868 wmic.exe Token: SeUndockPrivilege 2868 wmic.exe Token: SeManageVolumePrivilege 2868 wmic.exe Token: 33 2868 wmic.exe Token: 34 2868 wmic.exe Token: 35 2868 wmic.exe Token: 36 2868 wmic.exe Token: SeIncreaseQuotaPrivilege 2868 wmic.exe Token: SeSecurityPrivilege 2868 wmic.exe Token: SeTakeOwnershipPrivilege 2868 wmic.exe Token: SeLoadDriverPrivilege 2868 wmic.exe Token: SeSystemProfilePrivilege 2868 wmic.exe Token: SeSystemtimePrivilege 2868 wmic.exe Token: SeProfSingleProcessPrivilege 2868 wmic.exe Token: SeIncBasePriorityPrivilege 2868 wmic.exe Token: SeCreatePagefilePrivilege 2868 wmic.exe Token: SeBackupPrivilege 2868 wmic.exe Token: SeRestorePrivilege 2868 wmic.exe Token: SeShutdownPrivilege 2868 wmic.exe Token: SeDebugPrivilege 2868 wmic.exe Token: SeSystemEnvironmentPrivilege 2868 wmic.exe Token: SeRemoteShutdownPrivilege 2868 wmic.exe Token: SeUndockPrivilege 2868 wmic.exe Token: SeManageVolumePrivilege 2868 wmic.exe Token: 33 2868 wmic.exe Token: 34 2868 wmic.exe Token: 35 2868 wmic.exe Token: 36 2868 wmic.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2868 1688 BabkaLoader-1.exe 90 PID 1688 wrote to memory of 1016 1688 BabkaLoader-1.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\BabkaLoader-1.exe"C:\Users\Admin\AppData\Local\Temp\BabkaLoader-1.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic cpu get name2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -version2⤵PID:1016
-