latentbot | a7028400e3340564836d6e18af119bd0f01ed11de878996374b3e9e29e8ee901

Analysis

max time kernel
115s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
submitted
05/04/2024, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe
Size 407KB
Sample240405-wq897sbb86
SHA256 a7028400e3340564836d6e18af119bd0f01ed11de878996374b3e9e29e8ee901
MD5 db0d602a36ca0f329aabdac1a7698306
SHA1 f4de262554cbeefa2be901c9980efdce966e142d
SHA512 7446f619d4473e43b89c0d5546c58b2637a2beaeebc95749e6a8d94f6f2281afe55e6eae9610ad93d98851f8b58592e3c35448ef48eda57f06a72ee2f7d8a225
SSDEEP 12288:rjFiRWEJXC+mISVHOwcVlNe5F7k7BxX8twv0NzK:rRiRWEXFmIgHAbhBxX8ysz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

latentbot quasar criok defense_evasion discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Criok

ildriendfrirotoi.zapto.org:61790
fruitingsuccess.ignorelist.com:61789

Mutex

QSR_MUTEX_JS7TIscSksvJKrLXxw

Attributes

encryption_key
7RWfQmQNDJPIz1c1QtI1
install_name
Updater.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
Windows

Extracted

Family

latentbot

ildriendfrirotoi.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2268-12-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

System Binary Proxy Execution: InstallUtil 1 TTPs 2 IoCs

Abuse InstallUtil to proxy execution of malicious code.

defense_evasion

InstallUtil

T1218.004

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe
Key opened	\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\InstallUtil.exe	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	InstallUtil.exe

Executes dropped EXE 3 IoCs

pid	Process
3716	InstallUtil.exe
2268	InstallUtil.exe
3680	InstallUtil.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
37	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4116 set thread context of 2268	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
936	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
936	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe
4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe
4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe
4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe
4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe
4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe
Token: SeDebugPrivilege	2268	InstallUtil.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 3716	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe	103
PID 4116 wrote to memory of 3716	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe	103
PID 4116 wrote to memory of 3716	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe	103
PID 4116 wrote to memory of 2268	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe	104
PID 4116 wrote to memory of 2268	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe	104
PID 4116 wrote to memory of 2268	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe	104
PID 4116 wrote to memory of 2268	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe	104
PID 4116 wrote to memory of 2268	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe	104
PID 4116 wrote to memory of 2268	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe	104
PID 4116 wrote to memory of 2268	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe	104
PID 4116 wrote to memory of 2268	4116	db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe	104
PID 2268 wrote to memory of 1596	2268	InstallUtil.exe	106
PID 2268 wrote to memory of 1596	2268	InstallUtil.exe	106
PID 2268 wrote to memory of 1596	2268	InstallUtil.exe	106
PID 1596 wrote to memory of 2364	1596	cmd.exe	108
PID 1596 wrote to memory of 2364	1596	cmd.exe	108
PID 1596 wrote to memory of 2364	1596	cmd.exe	108
PID 1596 wrote to memory of 936	1596	cmd.exe	109
PID 1596 wrote to memory of 936	1596	cmd.exe	109
PID 1596 wrote to memory of 936	1596	cmd.exe	109
PID 1596 wrote to memory of 3680	1596	cmd.exe	110
PID 1596 wrote to memory of 3680	1596	cmd.exe	110
PID 1596 wrote to memory of 3680	1596	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\db0d602a36ca0f329aabdac1a7698306_JaffaCakes118.exe"
1⤵
- System Binary Proxy Execution: InstallUtil
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
  C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
  C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f7LNUvbaWgIz.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2364
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:936
  - - C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
      "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4260 --field-trial-handle=3488,i,1267426273081718772,6254127258555406296,262144 --variations-seed-version /prefetch:8
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

InstallUtil

T1218.004

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallUtil.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log
Size 1KB
SHA256 f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
MD5 10eab9c2684febb5327b6976f2047587
SHA1 a12ed54146a7f5c4c580416aecb899549712449e
SHA512 7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
MD5 SHA1 SHA512

Submit Download

InstallUtil.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
Size 41KB
SHA256 ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
MD5 5d4073b2eb6d217c19f2b22f21bf8d57
SHA1 f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA512 9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
SSDEEP 384:qtpFVLK0MsihB9VKS7xdgl6KJ9Yl6dnPU3SERztmbqCJstdMardz/JikPZ+RPZTg:GBMs2SqdSZ6Iq8BxTfqWR8h7ukP
MD5 SHA1 SHA512 SSDEEP

Submit Download

f7LNUvbaWgIz.bat

Path C:\Users\Admin\AppData\Local\Temp\f7LNUvbaWgIz.bat
Size 208B
SHA256 fa5b40b6d0a166f24769924bd5b36a055443d752f3ef72b705ab0b472cb30842
MD5 2be963f02949651bf9ad0e9da0fd956e
SHA1 c14de59d38ee67f2fbf62091ef6714d0b0dceb89
SHA512 5e08653005f32a7a0517e6f46a47f51485083519c83376ca363699f617721d72396b0c71d200b55c61b4f338f7b902fbf56b578bee360920e76e4cc92aa4c00f
MD5 SHA1 SHA512

Submit Download

memory/2268-19-0x0000000004E30000-0x0000000004EC2000-memory.dmp

Download

memory/2268-20-0x0000000004F00000-0x0000000004F10000-memory.dmp

Download

memory/2268-23-0x00000000060D0000-0x000000000610C000-memory.dmp

Download

memory/2268-22-0x0000000005050000-0x0000000005062000-memory.dmp

Download

memory/2268-21-0x0000000005080000-0x00000000050E6000-memory.dmp

Download

memory/2268-12-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/2268-28-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Download

memory/2268-17-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Download

memory/2268-18-0x0000000005340000-0x00000000058E4000-memory.dmp

Download

memory/3680-32-0x0000000000380000-0x000000000038C000-memory.dmp

Download

memory/3680-34-0x0000000074790000-0x0000000074F40000-memory.dmp

Download

memory/3680-33-0x0000000004B00000-0x0000000004B1A000-memory.dmp

Download

memory/3680-35-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Download

memory/3680-36-0x0000000074790000-0x0000000074F40000-memory.dmp

Download

memory/4116-16-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Download

memory/4116-2-0x0000000005070000-0x00000000050D4000-memory.dmp

Download

memory/4116-1-0x0000000000680000-0x00000000006EA000-memory.dmp

Download

memory/4116-0-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Download

memory/4116-4-0x00000000746F0000-0x0000000074EA0000-memory.dmp

Download

memory/4116-3-0x0000000005260000-0x0000000005270000-memory.dmp

Download

memory/4116-8-0x0000000005370000-0x00000000053AE000-memory.dmp

Download

memory/4116-5-0x0000000005260000-0x0000000005270000-memory.dmp

Download