latentbot | 6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
Size 632KB
Sample240410-nwnlpaed64
SHA256 6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918
MD5 0ad6bf767f5c45a6faf32a40c5807057
SHA1 e83e01d488e0036d7c8b9ce352f232f18c456a4f
SHA512 77ceda0cf480661c3efa35f2bca4093caf6937c55fa59c5d8efe1fb4a644bdc8a52d568947ce10227c29a91f508be62fd2efd5eee67d3664da79ca64fc76e645
SSDEEP 6144:BKFPt25YkF7cafVDxvET4hqqDLu6E10KZa1poIUoeeZIUwgbndISJTnnbxbJVsPc:Bv5PZvVDlsPqnuqKEPoIUa4K9niH8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

latentbot netwire botnet rat stealer trojan

Malware Config

Extracted

Family

netwire

atlaswebportal.zapto.org:4000

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
UD.27.03.17
lock_executable
false
offline_keylogger
false
password
Micr0s0ft4456877
registry_autorun
false
use_mutex
false

Extracted

Family

latentbot

atlaswebportal.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

NetWire RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/4172-5-0x0000000000400000-0x000000000041E000-memory.dmp	netwire
behavioral2/memory/4172-8-0x0000000000400000-0x000000000041E000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 4172	1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	95
PID 1532 wrote to memory of 4172	1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	95
PID 1532 wrote to memory of 4172	1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	95
PID 1532 wrote to memory of 4172	1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	95
PID 1532 wrote to memory of 4172	1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	95
PID 1532 wrote to memory of 4172	1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	95
PID 1532 wrote to memory of 4172	1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	95
PID 1532 wrote to memory of 4172	1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	95
PID 1532 wrote to memory of 4172	1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	95
PID 1532 wrote to memory of 4172	1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	95
PID 1532 wrote to memory of 4172	1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	95
PID 1532 wrote to memory of 4172	1532	6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe	95

C:\Users\Admin\AppData\Local\Temp\6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
"C:\Users\Admin\AppData\Local\Temp\6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Local\Temp\6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe
  "C:\Users\Admin\AppData\Local\Temp\6c2e873a3da1849ee1fc45bb1b09f4a4019495229ee7892048e23ba04cbd3918.exe"
  2⤵
  PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4760 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
1⤵
PID:860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-0-0x0000000002440000-0x00000000024BB000-memory.dmp

Download

memory/1532-1-0x0000000077702000-0x0000000077703000-memory.dmp

Download

memory/1532-3-0x0000000002440000-0x00000000024BB000-memory.dmp

Download

memory/4172-2-0x0000000077702000-0x0000000077703000-memory.dmp

Download

memory/4172-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/4172-5-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4172-8-0x0000000000400000-0x000000000041E000-memory.dmp

Download