File name:

DeltaTB.exe

Full analysis: https://app.any.run/tasks/b23a18ea-3b12-40cf-866a-fcfcaed9937b
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 07, 2024, 13:19:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
babylon
rat
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

FC21D8E387DBCD2E627B97BFC5B8F5CD

SHA1:

37CCAD86409E08816A4C00F1DBEA4604BA36D3A1

SHA256:

6054B54A561DF69B21AC35C5E76A3661412B404FF7404CFCA1D49BE20900A96A

SSDEEP:

24576:abeBKnmDofS4RucX2oGYsa6n7ehJ+czgj0HZI7StRLKvO+oTLuPvxK2UOKMeWtx:abeBKn5a4RuO2oGYsa6n7eD+czgj0HZi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • DeltaTB.exe (PID: 4088)

    • Steals credentials from Web Browsers

      • Setup.exe (PID: 1200)

    • BABYLON has been detected (SURICATA)

      • Setup.exe (PID: 1200)

    • Actions looks like stealing of personal data

      • Setup.exe (PID: 1200)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Setup.exe (PID: 1200)
      • rundll32.exe (PID: 2108)
      • IELowutil.exe (PID: 2032)

    • Executable content was dropped or overwritten

      • DeltaTB.exe (PID: 4088)

    • Reads security settings of Internet Explorer

      • IELowutil.exe (PID: 2032)
      • Setup.exe (PID: 1200)

    • Reads browser cookies

      • Setup.exe (PID: 1200)

    • Loads DLL from Mozilla Firefox

      • Setup.exe (PID: 1200)

    • Uses RUNDLL32.EXE to load library

      • Setup.exe (PID: 1200)

    • Potential Corporate Privacy Violation

      • Setup.exe (PID: 1200)

    • Process requests binary or script from the Internet

      • Setup.exe (PID: 1200)

  • INFO

    • Creates files or folders in the user directory

      • Setup.exe (PID: 1200)

    • Create files in a temporary directory

      • DeltaTB.exe (PID: 4088)
      • Setup.exe (PID: 1200)

    • Checks supported languages

      • DeltaTB.exe (PID: 4088)
      • Setup.exe (PID: 1200)
      • wmpnscfg.exe (PID: 552)
      • IELowutil.exe (PID: 2032)

    • Reads the computer name

      • Setup.exe (PID: 1200)
      • IELowutil.exe (PID: 2032)
      • wmpnscfg.exe (PID: 552)

    • Creates files in the program directory

      • Setup.exe (PID: 1200)

    • Checks proxy server information

      • IELowutil.exe (PID: 2032)
      • Setup.exe (PID: 1200)
      • rundll32.exe (PID: 2108)

    • Reads the machine GUID from the registry

      • IELowutil.exe (PID: 2032)
      • Setup.exe (PID: 1200)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 552)

    • Process checks whether UAC notifications are on

      • Setup.exe (PID: 1200)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 2108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:06:16 11:48:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 12288
InitializedDataSize: 767488
UninitializedDataSize: -
EntryPoint: 0x1595
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start deltatb.exe #BABYLON setup.exe rundll32.exe no specs ielowutil.exe no specs wmpnscfg.exe no specs deltatb.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
552"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1200"C:\Users\admin\AppData\Local\Temp\272CBA8C-BAB0-7891-93E9-1AB7A392788B\Setup.exe" -aflt=babsst -srcext=ss -s -instlref=sst -xprm="cat=delta" C:\Users\admin\AppData\Local\Temp\272CBA8C-BAB0-7891-93E9-1AB7A392788B\Setup.exe
DeltaTB.exe
User:
admin
Company:
Babylon Ltd.
Integrity Level:
HIGH
Description:
Setup Application
Exit code:
0
Version:
9.1.1.14
Modules
Images
c:\users\admin\appdata\local\temp\272cba8c-bab0-7891-93e9-1ab7a392788b\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2032"C:\Program Files\Internet Explorer\IELowutil.exe" -PID:123C:\Program Files\Internet Explorer\IELowutil.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Low-Mic Utility Tool
Exit code:
2147942487
Version:
11.00.9600.19597 (winblue_ltsb_escrow.191216-1311)
Modules
Images
c:\program files\internet explorer\ielowutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
2108"C:\Windows\system32\rundll32.exe" C:\Users\admin\AppData\Local\Temp\272CBA~1\IEHelper.dll,UpdateProtectedModeCookieCache URI|http://babylon.comC:\Windows\System32\rundll32.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3976"C:\Users\admin\AppData\Local\Temp\DeltaTB.exe" C:\Users\admin\AppData\Local\Temp\DeltaTB.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\deltatb.exe
c:\windows\system32\ntdll.dll
4088"C:\Users\admin\AppData\Local\Temp\DeltaTB.exe" C:\Users\admin\AppData\Local\Temp\DeltaTB.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\deltatb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
2 248
Read events
2 139
Write events
83
Delete events
26

Modification events

(PID) Process:(1200) Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer
Operation:delete valueName:IECookies
Value:
(PID) Process:(1200) Setup.exeKey:HKEY_CURRENT_USER\Software\BabyTest
Operation:delete keyName:(default)
Value:
(PID) Process:(1200) Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\BabyTest
Operation:delete keyName:(default)
Value:
(PID) Process:(1200) Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Test.cap
Operation:delete keyName:(default)
Value:
(PID) Process:(2108) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2108) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2108) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2108) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2108) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2108) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
Executable files
4
Suspicious files
13
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
4088DeltaTB.exeC:\Users\admin\AppData\Local\Temp\272CBA8C-BAB0-7891-93E9-1AB7A392788B\bab091.norecovericon.datbinary
MD5:4F6E1FDBEF102CDBD379FDAC550B9F48
SHA256:E58EA352C050E6353FB5B4FA32A97800298C1603489D3B47794509AF6C89EC4C
4088DeltaTB.exeC:\Users\admin\AppData\Local\Temp\272CBA8C-BAB0-7891-93E9-1AB7A392788B\bab307.sp_pop0.datbinary
MD5:0B7BE9C4B72C2C5166BFD61CA5EBBFED
SHA256:673BF972D308BC6108360575608CF72F393413F2D3993489B06DA4A6EFC749BD
4088DeltaTB.exeC:\Users\admin\AppData\Local\Temp\272CBA8C-BAB0-7891-93E9-1AB7A392788B\bab148.spreg.datbinary
MD5:A4AF0A0C254B38F2F9EECBF0E00B08FE
SHA256:810E0E32D54B9E1557DA7CCF1CA9F6354814E90DADC6B4AF5E1CBDF87FAC925A
4088DeltaTB.exeC:\Users\admin\AppData\Local\Temp\272CBA8C-BAB0-7891-93E9-1AB7A392788B\HtmlScreens\loading.htmlhtml
MD5:F50FA4673555652289652753183FD1EE
SHA256:AFB21B51CEAD30ED14F79293D50B9C3C7A706B5287AAD6CDE06EA44A364DF812
4088DeltaTB.exeC:\Users\admin\AppData\Local\Temp\272CBA8C-BAB0-7891-93E9-1AB7A392788B\bab456.TB_OldWay.datbinary
MD5:7E72D256E34635D351092955D1F8516B
SHA256:39EB1667A67149B5D930E5408896027E3C3FC06282735E61CB8D85F5B38F587C
4088DeltaTB.exeC:\Users\admin\AppData\Local\Temp\272CBA8C-BAB0-7891-93E9-1AB7A392788B\IEHelper.dllexecutable
MD5:A21DE5067618D4F2DF261416315ED120
SHA256:6D13D2967A37BA76F840CD45DBA565C5D64938A99D886243F01713CD018E53CA
4088DeltaTB.exeC:\Users\admin\AppData\Local\Temp\272CBA8C-BAB0-7891-93E9-1AB7A392788B\HtmlScreens\pBar.gifimage
MD5:26621CB27BBC94F6BAB3561791AC013B
SHA256:E512D5B772FEF448F724767662E3A6374230157E35CAB6F4226496ACC7AA7AD3
4088DeltaTB.exeC:\Users\admin\AppData\Local\Temp\272CBA8C-BAB0-7891-93E9-1AB7A392788B\bab033.tbinst.datbinary
MD5:90713AB7A74884CD36A5FB4CFCDECE8A
SHA256:BC40813F6D07DBC1A4D4C74363460D1AD6EE76275729DE4C4F10EC40D8CC46EB
4088DeltaTB.exeC:\Users\admin\AppData\Local\Temp\272CBA8C-BAB0-7891-93E9-1AB7A392788B\BExternal.dllexecutable
MD5:B212865E7E478A28A97268F960079A8D
SHA256:D6138AEF3F7674E2442ADD75013C86CA8FDA3D5BA69737A9B881E7F7BBC730E6
1200Setup.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
9
DNS requests
6
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1200
Setup.exe
GET
—
184.154.27.232:80
http://stat.info-stream.net/report.php?no_policy=1&lang=0&source=setup-start&stage=0&ver=9.1.1.14&guid={D3AF4D82-95B7-441E-A822-7E61B8C36C09}&mntrId=C4BA12A9866C77DE&moldid=c4ba364700000000000012a9866c77de&sufn=Explorer.EXE&iev=11&ffv=115&crv=109&dwb=msedge&dlb=ie&wbr=1&tsn=12459796&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=601&tbtp=def&tbinst=1&cntry=US&cat=delta&uac=1&osp=hp0:642845648;hp1:0;hp2:0;dsp0:-886302982;dsp1:0;dsp2:0;&dnt=2.0,3.0,3.5,4.0
unknown
—
—
unknown
1200
Setup.exe
GET
—
198.143.128.244:80
http://dl.babylon.com/site/files/Setup9/dwr/DefaultToolbar/DefaultToolbar/Setup-tbdef.zpb
unknown
—
—
unknown
1200
Setup.exe
GET
404
198.143.128.244:80
http://dl.babylon.com/site/files/Setup9/dwr/DefaultClient/DefaultClient/Default-tbdat.zpb
unknown
—
—
unknown
1200
Setup.exe
GET
200
184.154.27.232:80
http://stat.info-stream.net/report.php?no_policy=1&lang=0&source=setup-end&stage=-8&ver=9.1.1.14&guid={D3AF4D82-95B7-441E-A822-7E61B8C36C09}&mntrId=C4BA12A9866C77DE&moldid=c4ba364700000000000012a9866c77de&sufn=Explorer.EXE&iev=11&ffv=115&crv=109&dwb=msedge&dlb=ie&wbr=1&tsn=12459796&ibprs=NA&ibprv=0&sutp=50&sufl=66&tbp=0&prver=0&minreq=0&dtct=-10000000&wvr=601&tbtp=def&tbinst=1&cntry=US&cat=delta&uac=1&osp=hp0:642845648;hp1:0;hp2:0;dsp0:-886302982;dsp1:0;dsp2:0;&dnt=2.0,3.0,3.5,4.0&hp=0&dsp=0&tb=1&hpx=0&dspx=0&rvrt=0&excd=10&stm=99&nvs=0&dnld=0&dcnt=2&dtot=2&dlerr=65543&dltm=32&dlsz=0&dsflr=2&errurl=Setup-tbdef.zpb&hpc=1998245871&spc=1998245871&tbx=0
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1200
Setup.exe
184.154.27.232:80
stat.info-stream.net
SINGLEHOP-LLC
US
unknown
1200
Setup.exe
198.143.128.244:80
dl.babylon.com
SINGLEHOP-LLC
US
unknown

DNS requests

Domain
IP
Reputation
stat.info-stream.net
  • 184.154.27.232
whitelisted
stp.babylon.com
  • 184.154.27.232
whitelisted
dl.babylon.com
  • 198.143.128.244
unknown

Threats

PID
Process
Class
Message
1200
Setup.exe
Potential Corporate Privacy Violation
ET POLICY Babylon User-Agent (Translation App Observed in PPI MALWARE)
—
—
Potential Corporate Privacy Violation
ET POLICY Babylon User-Agent (Translation App Observed in PPI MALWARE)
—
—
Potential Corporate Privacy Violation
ET POLICY Babylon User-Agent (Translation App Observed in PPI MALWARE)
—
—
Potential Corporate Privacy Violation
ET POLICY Babylon User-Agent (Translation App Observed in PPI MALWARE)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DeltaTB.exe