Resubmissions
12/04/2024, 14:40
240412-r19aqsec6y 1012/04/2024, 14:40
240412-r18n7sec6x 1012/04/2024, 14:36
240412-rylfwsbc28 1012/04/2024, 14:36
240412-rykvcsec4t 1012/04/2024, 14:36
240412-rykjlaec4s 809/04/2024, 07:38
240409-jgem1shg29 809/04/2024, 07:38
240409-jgdqqahg28 1009/04/2024, 07:38
240409-jgc47ada4y 1009/04/2024, 07:38
240409-jgctesda4v 825/12/2023, 04:54
231225-fjlybsahbr 7Analysis
-
max time kernel
340s -
max time network
1203s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
-
submitted
09/04/2024, 07:38
General
-
Target
2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250.exe
-
Size
1.9MB
-
MD5
59646583129acf5244d686f15aadb25a
-
SHA1
5b8b55dc12217eb37bd25ca61cd7aceec729e603
-
SHA256
2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250
-
SHA512
99a4c6612de866f966f2b9f84c16ada59d3606db942011d720debe12f4b059a9aec1b7c1046231b15ae728b6a27e616056588680aa3ebcbf0340a4d6eeddb9b2
-
SSDEEP
49152:Qe6RRRpEHQN/ThQrezxMQnXW8qaJZkRLagEoH6gFt:Q9nLEcrhhmYLwpbE+t
Malware Config
Extracted
latentbot
animetracker.zapto.org
Signatures
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Contacts a large (877) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
UPX packed file 45 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250.exe"C:\Users\Admin\AppData\Local\Temp\2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250.exe"C:\Users\Admin\AppData\Local\Temp\2cdc39f39a9369ae4062822ea6726f2e508d5d29514b3cee06f809ce6ef16250.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD55777d56460efb8519bcfe961647ffcc8
SHA1cb180d9885a517ec254c1fb7271e02de5bb3a73a
SHA256a10fc5dda3f349841a63877282650e21b6a4fd3176e48d607cbdbaaef5b1bd66
SHA512cdfd33d9d5ebf919431cd7a12f1b55137ab7005c69e2941c6e15ee081ecf2137ef4e272c4f40fbadd6f3c1b45f08aba31bc6ec0bd394f8fc3abf310cb64e7bbf
-
Filesize
5.6MB
MD5ec2d81a27528c5890c4c0c52806d8f00
SHA18ab38a3ec1a0184f95c6c83ca3328465af8212c9
SHA25652fbe86e952ab644cab0607b2fbab902f2bbafbb3157c2d84b216694095e9f99
SHA51264dd16a7e9d383b5a595c28d701a4b8aad840b369f0788b4041e4f28d8708e5416dd4149f60483a9878cd2958f285612f7e0a42e1f89ab87b9cdbf3186f17e71
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB