latentbot | 148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4

Analysis

max time kernel
143s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
Size 164KB
Sample240410-lrk9naba98
SHA256 148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4
MD5 bfd3e1a3926fd5ef4eec1ac533f2ee34
SHA1 1d931fbf3f5f171fa8a1a51d35d28c05d568c7bf
SHA512 f3cb7369cec02848f27a6d1006c580fcd4d173bb7b2a0d0985af15fb18081b6f428f4eadfd067186c4564f89c775997278f7265b76c048d8fdc81e22c096a9b7
SSDEEP 3072:2WDMqqDLy/OVBiWpvzJezo/Q/Bsm6WKHaPQWdn96xgnYtD1MQl00x/5gVBd:WqqDLuOv4/mm6WhowngyY5Z00x/5e3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

latentbot netwire botnet rat stealer trojan

Malware Config

Extracted

Family

netwire

knudandersen.zapto.org:21000

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
UN_23.01.17
keylogger_dir
C:\NVIDIA\profile\
lock_executable
false
offline_keylogger
true
password
1@wi%252ReNd5y0576Z*
registry_autorun
false
use_mutex
false

Extracted

Family

latentbot

knudandersen.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

NetWire RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4488-2-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4488-5-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4488-9-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4488-10-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\.Identifier	explorer.exe
File opened for modification	C:\Windows\SysWOW64\.Identifier	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4488	4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	98
PID 4248 wrote to memory of 4488	4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	98
PID 4248 wrote to memory of 4488	4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	98
PID 4248 wrote to memory of 4488	4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	98
PID 4248 wrote to memory of 4488	4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	98
PID 4248 wrote to memory of 4488	4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	98
PID 4248 wrote to memory of 4488	4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	98
PID 4248 wrote to memory of 4488	4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	98
PID 4248 wrote to memory of 4488	4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	98
PID 4248 wrote to memory of 4488	4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	98
PID 4248 wrote to memory of 4488	4248	148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe	98

C:\Users\Admin\AppData\Local\Temp\148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe
"C:\Users\Admin\AppData\Local\Temp\148dc24231816bda62508aa79bbb96f00b65d0e6b429a80bf0cd5e9206a56ed4.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Drops file in System32 directory
  PID:4488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4248-0-0x0000000002260000-0x00000000022DB000-memory.dmp

Download

memory/4248-1-0x0000000077172000-0x0000000077173000-memory.dmp

Download

memory/4248-4-0x0000000002260000-0x00000000022DB000-memory.dmp

Download

memory/4488-2-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4488-3-0x0000000077172000-0x0000000077173000-memory.dmp

Download

memory/4488-5-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4488-8-0x0000000001100000-0x0000000001101000-memory.dmp

Download

memory/4488-9-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4488-10-0x0000000000400000-0x000000000041E000-memory.dmp

Download