latentbot | 30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24

Analysis

max time kernel
153s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 10:11

Target

30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe
Size

296KB
MD5

ad1b6380efb0aad16f01bd1a23f2e649
SHA1

09fc136cf022ea2fd176c1d8a6b6e2f8de54bd3d
SHA256

30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24
SHA512

2080a929ca0cc84c714d4085ee6c4f13fe4cc4aa809936bf8a596951134034d7ed0b2713a150b17916271f7b35ce2dcf19931128c6bf7fcf03a13604042919e9
SSDEEP

6144:iqqDLuTz9dnBqi2viVlDaaf6QRHursR+EvtW7IkXVUWlvddk:XqnuTRAErSQd/vvp2

Score

10^/10

Family

netwire

knudandersen.zapto.org:21000

Attributes

Family

latentbot

knudandersen.zapto.org

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2132-5-0x0000000000400000-0x0000000000420000-memory.dmp	netwire
behavioral2/memory/2132-8-0x0000000000400000-0x0000000000420000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious behavior: EnumeratesProcesses 8 IoCs

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 2132	3868	30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe	98
PID 3868 wrote to memory of 2132	3868	30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe	98
PID 3868 wrote to memory of 2132	3868	30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe	98
PID 3868 wrote to memory of 2132	3868	30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe	98
PID 3868 wrote to memory of 2132	3868	30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe	98
PID 3868 wrote to memory of 2132	3868	30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe	98
PID 3868 wrote to memory of 2132	3868	30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe	98
PID 3868 wrote to memory of 2132	3868	30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe	98
PID 3868 wrote to memory of 2132	3868	30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe	98
PID 3868 wrote to memory of 2132	3868	30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe	98
PID 3868 wrote to memory of 2132	3868	30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe	98
PID 3868 wrote to memory of 2132	3868	30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe	98

C:\Users\Admin\AppData\Local\Temp\30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe
"C:\Users\Admin\AppData\Local\Temp\30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Users\Admin\AppData\Local\Temp\30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe
  "C:\Users\Admin\AppData\Local\Temp\30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24.exe"
  2⤵
  PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1292 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:3600

memory/2132-2-0x0000000077762000-0x0000000077763000-memory.dmp

Filesize
4KB

Download
memory/2132-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2132-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2132-8-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3868-0-0x0000000002280000-0x00000000022FB000-memory.dmp

Filesize
492KB

Download
memory/3868-1-0x0000000077762000-0x0000000077763000-memory.dmp

Filesize
4KB

Download
memory/3868-3-0x0000000002280000-0x00000000022FB000-memory.dmp

Filesize
492KB

Download