latentbot | 148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 09:46

Target

148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
Size

164KB
MD5

bfd3e1a3926fd5ef4eec1ac533f2ee34
SHA1

1d931fbf3f5f171fa8a1a51d35d28c05d568c7bf
SHA256

148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4
SHA512

f3cb7369cec02848f27a6d1006c580fcd4d173bb7b2a0d0985af15fb18081b6f428f4eadfd067186c4564f89c775997278f7265b76c048d8fdc81e22c096a9b7
SSDEEP

3072:2WDMqqDLy/OVBiWpvzJezo/Q/Bsm6WKHaPQWdn96xgnYtD1MQl00x/5gVBd:WqqDLuOv4/mm6WhowngyY5Z00x/5e3

Score

10^/10

Family

netwire

knudandersen.zapto.org:21000

Attributes

Family

latentbot

knudandersen.zapto.org

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2504-2-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/2504-5-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/2504-8-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral1/memory/2504-10-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\.Identifier	explorer.exe
File opened for modification	C:\Windows\SysWOW64\.Identifier	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2504	2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	28
PID 2280 wrote to memory of 2504	2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	28
PID 2280 wrote to memory of 2504	2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	28
PID 2280 wrote to memory of 2504	2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	28
PID 2280 wrote to memory of 2504	2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	28
PID 2280 wrote to memory of 2504	2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	28
PID 2280 wrote to memory of 2504	2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	28
PID 2280 wrote to memory of 2504	2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	28
PID 2280 wrote to memory of 2504	2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	28
PID 2280 wrote to memory of 2504	2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	28
PID 2280 wrote to memory of 2504	2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	28
PID 2280 wrote to memory of 2504	2280	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	28

C:\Users\Admin\AppData\Local\Temp\148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
"C:\Users\Admin\AppData\Local\Temp\148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Drops file in System32 directory
  PID:2504

memory/2280-0-0x0000000001D00000-0x0000000001D7B000-memory.dmp

Filesize
492KB

Download
memory/2280-1-0x00000000778FF000-0x0000000077900000-memory.dmp

Filesize
4KB

Download
memory/2280-3-0x0000000001D00000-0x0000000001D7B000-memory.dmp

Filesize
492KB

Download
memory/2504-2-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2504-5-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2504-4-0x00000000778FF000-0x0000000077900000-memory.dmp

Filesize
4KB

Download
memory/2504-6-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/2504-8-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2504-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download