Windows Analysis Report
init_DB.exe

Overview

General Information

Sample name: init_DB.exe
Analysis ID: 1430160
MD5: f2663571882c3baa5633db216443cc0a
SHA1: 85a1283578cef91b29c155c8179733332d48b7c9
SHA256: de3dfcb68228e7f64f30e64980ad8da6629da73b10d5172762aba76721372b7c
Infos:

Detection

Babadeda
Score: 60
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Babadeda
Machine Learning detection for sample
Contains functionality to dynamically determine API calls
Detected potential crypto function
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files

Classification

Name Description Attribution Blogpost URLs Link
Babadeda According to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus engines. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.babadeda

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: init_DB.exe ReversingLabs: Detection: 50%
Source: init_DB.exe Virustotal: Detection: 39% Perma Link
Machine Learning detection for sample
Source: init_DB.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: init_DB.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: C:\Users\user\Desktop\init_DB.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe File opened: C:\Users\user\AppData\Local\Temp\1413.tmp\1414.tmp Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe File opened: C:\Users\user\AppData\Local\Temp\1413.tmp Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe File opened: C:\Users\user\AppData\Local\Temp\1413.tmp\1414.tmp\1415.tmp Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_00411079 0_2_00411079
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_00411C20 0_2_00411C20
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_00411033 0_2_00411033
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_00410C80 0_2_00410C80
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_00410CA0 0_2_00410CA0
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_0040B9C7 0_2_0040B9C7
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_0040FA68 0_2_0040FA68
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_0040CF18 0_2_0040CF18
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_0040EFF0 0_2_0040EFF0
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_00410FB0 0_2_00410FB0
Uses 32bit PE files
Source: init_DB.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: mal60.troj.winEXE@4/1@0/0
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_00402664 LoadResource,SizeofResource,FreeResource, 0_2_00402664
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4564:120:WilError_03
Source: C:\Users\user\Desktop\init_DB.exe File created: C:\Users\user\AppData\Local\Temp\1413.tmp Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\1413.tmp\1414.tmp\1415.bat C:\Users\user\Desktop\init_DB.exe"
Source: C:\Users\user\Desktop\init_DB.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: init_DB.exe ReversingLabs: Detection: 50%
Source: init_DB.exe Virustotal: Detection: 39%
Source: unknown Process created: C:\Users\user\Desktop\init_DB.exe "C:\Users\user\Desktop\init_DB.exe"
Source: C:\Users\user\Desktop\init_DB.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\init_DB.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\1413.tmp\1414.tmp\1415.bat C:\Users\user\Desktop\init_DB.exe"
Source: C:\Users\user\Desktop\init_DB.exe Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\1413.tmp\1414.tmp\1415.bat C:\Users\user\Desktop\init_DB.exe" Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior

Data Obfuscation
barindex
Yara detected Babadeda
Source: Yara match File source: init_DB.exe, type: SAMPLE
Source: Yara match File source: 0.0.init_DB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.init_DB.exe.400000.0.unpack, type: UNPACKEDPE
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_0040ADD6 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary, 0_2_0040ADD6
PE file contains sections with non-standard names
Source: init_DB.exe Static PE information: section name: .code
Source: C:\Users\user\Desktop\init_DB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\init_DB.exe File opened: C:\Users\user\AppData\ Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe File opened: C:\Users\user\AppData\Local\Temp\1413.tmp\1414.tmp Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe File opened: C:\Users\user\ Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe File opened: C:\Users\user\AppData\Local\ Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe File opened: C:\Users\user\AppData\Local\Temp\1413.tmp Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe File opened: C:\Users\user\AppData\Local\Temp\1413.tmp\1414.tmp\1415.tmp Jump to behavior
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_0040ADD6 GetTempPathW,LoadLibraryW,GetProcAddress,GetLongPathNameW,FreeLibrary, 0_2_0040ADD6
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_00409FD0 SetUnhandledExceptionFilter, 0_2_00409FD0
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_00409FB0 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter, 0_2_00409FB0
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\init_DB.exe Code function: 0_2_00405573 GetVersionExW,GetVersionExW, 0_2_00405573
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1430160 Sample: init_DB.exe Startdate: 23/04/2024 Architecture: WINDOWS Score: 60 12 Multi AV Scanner detection for submitted file 2->12 14 Yara detected Babadeda 2->14 16 Machine Learning detection for sample 2->16 6 init_DB.exe 8 2->6         started        process3 process4 8 cmd.exe 1 6->8         started        10 conhost.exe 6->10         started       
⊘No contacted IP infos