latentbot | 315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef

Analysis

max time kernel
143s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 10:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe
Size 724KB
Sample240410-l8l8aaca45
SHA256 315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef
MD5 93bed674dacbf3959c103711164747bf
SHA1 a9cc783a41ed3af7d51f0567ae3fc6f7bf6de087
SHA512 93609b20c6b8eb37e3f306b45a4c735a1a9b802198d3a22c792a7737f37b0975aef655ecd4db727a069916c8237e651f6d6ca38a53d4c1faeb1100dd25ddccf5
SSDEEP 3072:ozMqqDLy/dxaWhaETK0/SryFoWiYc+/vcbef50JUaRKV/1aDVnILrzZ2Cwifp+Cz:VqqDLubaEpbHOC/5TIwObIcLmjSZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

latentbot netwire botnet rat stealer trojan

Malware Config

Extracted

Family

netwire

knudandersen.zapto.org:21000

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
UD.28.02.17
keylogger_dir
C:\NVIDIA\profile\
lock_executable
false
offline_keylogger
true
password
1@wi%252ReNd5y0576Z*
registry_autorun
false
use_mutex
false

Extracted

Family

latentbot

knudandersen.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2468-7-0x0000000000400000-0x0000000000420000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2252	1444	WerFault.exe	85

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe
1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe
1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe
1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe
1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe
1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe
1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe
1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2468	1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe	92
PID 1444 wrote to memory of 2468	1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe	92
PID 1444 wrote to memory of 2468	1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe	92
PID 1444 wrote to memory of 2468	1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe	92
PID 1444 wrote to memory of 2468	1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe	92
PID 1444 wrote to memory of 2468	1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe	92
PID 1444 wrote to memory of 2468	1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe	92
PID 1444 wrote to memory of 2468	1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe	92
PID 1444 wrote to memory of 2468	1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe	92
PID 1444 wrote to memory of 2468	1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe	92
PID 1444 wrote to memory of 2468	1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe	92
PID 1444 wrote to memory of 2468	1444	315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe	92

C:\Users\Admin\AppData\Local\Temp\315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe
"C:\Users\Admin\AppData\Local\Temp\315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 380
  2⤵
  - Program crash
  PID:2252
- C:\Users\Admin\AppData\Local\Temp\315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe
  "C:\Users\Admin\AppData\Local\Temp\315f7c6e7ad4ffd96acfa73d4c196e32214ed2aa4182e8cfbb518c7981d971ef.exe"
  2⤵
  PID:2468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1444 -ip 1444
1⤵
PID:1680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-0-0x0000000000B00000-0x0000000000B7B000-memory.dmp

Download

memory/1444-1-0x00000000774E2000-0x00000000774E3000-memory.dmp

Download

memory/1444-2-0x0000000000B00000-0x0000000000B7B000-memory.dmp

Download

memory/2468-3-0x00000000774E2000-0x00000000774E3000-memory.dmp

Download

memory/2468-6-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/2468-7-0x0000000000400000-0x0000000000420000-memory.dmp

Download