Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
13/02/2024, 23:09
Behavioral task
behavioral1
Sample
9a27e7f280ba28570bc127b286a96d7e.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
General
- Target 9a27e7f280ba28570bc127b286a96d7e.exe
- Size 756KB
- Sample240213-2446asbc6t
- SHA256 d5fe408bf652e756b0e2c30aacb9f5135c9ef22598cc508d012fb70434e19055
- MD5 9a27e7f280ba28570bc127b286a96d7e
- SHA1 9841e19004683dca3edef18e7b7b29e4f2f1f67a
- SHA512 5246b17f1c1299eeec8416cbce1bcc12d1d693500660ef0241e70bdcd2a26f59cd987b7c20dbb3995536bded26e6393f49a6be7f6c192861a35b39a71cd6a0e2
- SSDEEP 12288:p9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKAebHhwhE:PAQ6Zx9cxTmOrucTIEFSpOGMHhwhE
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
latentbot
C2
-
testserver10101.zapto.org
Signatures
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 9a27e7f280ba28570bc127b286a96d7e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1716 set thread context of 1036 1716 9a27e7f280ba28570bc127b286a96d7e.exe 85 - Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 9a27e7f280ba28570bc127b286a96d7e.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 9a27e7f280ba28570bc127b286a96d7e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 9a27e7f280ba28570bc127b286a96d7e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 9a27e7f280ba28570bc127b286a96d7e.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 9a27e7f280ba28570bc127b286a96d7e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeSecurityPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeTakeOwnershipPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeLoadDriverPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeSystemProfilePrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeSystemtimePrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeProfSingleProcessPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeIncBasePriorityPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeCreatePagefilePrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeBackupPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeRestorePrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeShutdownPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeDebugPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeSystemEnvironmentPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeChangeNotifyPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeRemoteShutdownPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeUndockPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeManageVolumePrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeImpersonatePrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeCreateGlobalPrivilege 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: 33 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: 34 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: 35 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: 36 1716 9a27e7f280ba28570bc127b286a96d7e.exe Token: SeIncreaseQuotaPrivilege 1036 explorer.exe Token: SeSecurityPrivilege 1036 explorer.exe Token: SeTakeOwnershipPrivilege 1036 explorer.exe Token: SeLoadDriverPrivilege 1036 explorer.exe Token: SeSystemProfilePrivilege 1036 explorer.exe Token: SeSystemtimePrivilege 1036 explorer.exe Token: SeProfSingleProcessPrivilege 1036 explorer.exe Token: SeIncBasePriorityPrivilege 1036 explorer.exe Token: SeCreatePagefilePrivilege 1036 explorer.exe Token: SeBackupPrivilege 1036 explorer.exe Token: SeRestorePrivilege 1036 explorer.exe Token: SeShutdownPrivilege 1036 explorer.exe Token: SeDebugPrivilege 1036 explorer.exe Token: SeSystemEnvironmentPrivilege 1036 explorer.exe Token: SeChangeNotifyPrivilege 1036 explorer.exe Token: SeRemoteShutdownPrivilege 1036 explorer.exe Token: SeUndockPrivilege 1036 explorer.exe Token: SeManageVolumePrivilege 1036 explorer.exe Token: SeImpersonatePrivilege 1036 explorer.exe Token: SeCreateGlobalPrivilege 1036 explorer.exe Token: 33 1036 explorer.exe Token: 34 1036 explorer.exe Token: 35 1036 explorer.exe Token: 36 1036 explorer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1036 explorer.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1036 1716 9a27e7f280ba28570bc127b286a96d7e.exe 85 PID 1716 wrote to memory of 1036 1716 9a27e7f280ba28570bc127b286a96d7e.exe 85 PID 1716 wrote to memory of 1036 1716 9a27e7f280ba28570bc127b286a96d7e.exe 85 PID 1716 wrote to memory of 1036 1716 9a27e7f280ba28570bc127b286a96d7e.exe 85 PID 1716 wrote to memory of 1036 1716 9a27e7f280ba28570bc127b286a96d7e.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a27e7f280ba28570bc127b286a96d7e.exe"C:\Users\Admin\AppData\Local\Temp\9a27e7f280ba28570bc127b286a96d7e.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1036
-