latentbot | 6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918

Analysis

max time kernel
151s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-04-2024 11:44

Target

6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
Size

632KB
MD5

0ad6bf767f5c45a6faf32a40c5807057
SHA1

e83e01d488e0036d7c8b9ce352f232f18c456a4f
SHA256

6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918
SHA512

77ceda0cf480661c3efa35f2bca4093caf6937c55fa59c5d8efe1fb4a644bdc8a52d568947ce10227c29a91f508be62fd2efd5eee67d3664da79ca64fc76e645
SSDEEP

6144:BKFPt25YkF7cafVDxvET4hqqDLu6E10KZa1poIUoeeZIUwgbndISJTnnbxbJVsPc:Bv5PZvVDlsPqnuqKEPoIUa4K9niH8

Score

10^/10

Family

netwire

atlaswebportal.zapto.org:4000

Attributes

Family

latentbot

atlaswebportal.zapto.org

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/2592-7-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27
PID 2116 wrote to memory of 2592	2116	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	27

C:\Users\Admin\AppData\Local\Temp\6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
"C:\Users\Admin\AppData\Local\Temp\6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
  "C:\Users\Admin\AppData\Local\Temp\6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe"
  2⤵
  PID:2592

memory/2116-0-0x00000000002D0000-0x000000000034B000-memory.dmp

Filesize
492KB

Download
memory/2116-1-0x00000000776CF000-0x00000000776D0000-memory.dmp

Filesize
4KB

Download
memory/2116-2-0x00000000002D0000-0x000000000034B000-memory.dmp

Filesize
492KB

Download
memory/2592-6-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2592-7-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2592-3-0x00000000776CF000-0x00000000776D0000-memory.dmp

Filesize
4KB

Download