latentbot | 534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe
Size

168KB
MD5

ac65e7d08e48c6d20e3f90f7d9f73d8b
SHA1

1dc7aa5ededab0009c6e693d2f713da4fd85cb17
SHA256

534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5
SHA512

8ca3bda79d5427d2476e5ea2a20682c76c4dc34673f36b1499cc492d1bd2a31be24a45b9a15e15f28de92c1aa48256722814b2d6827de606f4e907595f16e372
SSDEEP

3072:2wUTTMqqDLy/0hSO4aMH8s/0K/dM7ry4VtmOo/KhtLL1YZYTb7Qw5:3qqDLu0hSjau/0K/UW47JrLxQ

Score

10^/10

latentbot netwire botnet rat stealer trojan upx

Malware Config

Extracted

Family

netwire

atlaswebportal.zapto.org:4000

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
1.6_R1_18.06.16
keylogger_dir
C:\NVIDIA\profile\
lock_executable
false
offline_keylogger
true
password
Micr0s0ft4456877
registry_autorun
false
use_mutex
false

Extracted

Family

latentbot

atlaswebportal.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

NetWire RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/436-5-0x0000000000400000-0x0000000000421000-memory.dmp	netwire
behavioral2/memory/436-10-0x0000000000400000-0x0000000000421000-memory.dmp	netwire
behavioral2/memory/436-14-0x0000000000400000-0x0000000000421000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/436-2-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/436-4-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/436-5-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/436-10-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/436-14-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe
972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe
972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe
972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe
972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe
972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe
972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe
972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95
PID 972 wrote to memory of 436	972	534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe	95

C:\Users\Admin\AppData\Local\Temp\534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe
"C:\Users\Admin\AppData\Local\Temp\534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  PID:436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/436-11-0x0000000076610000-0x0000000076700000-memory.dmp

Filesize
960KB

Download
memory/436-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/436-2-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/436-3-0x0000000077182000-0x0000000077183000-memory.dmp

Filesize
4KB

Download
memory/436-4-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/436-5-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/436-15-0x0000000076610000-0x0000000076700000-memory.dmp

Filesize
960KB

Download
memory/436-14-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/436-12-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/436-13-0x0000000077182000-0x0000000077183000-memory.dmp

Filesize
4KB

Download
memory/436-8-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/972-0-0x0000000002220000-0x000000000229B000-memory.dmp

Filesize
492KB

Download
memory/972-9-0x0000000002220000-0x000000000229B000-memory.dmp

Filesize
492KB

Download
memory/972-1-0x0000000077182000-0x0000000077183000-memory.dmp

Filesize
4KB

Download