latentbot | b2a9a9fcfcf83a0b9d6e8c44458a0fcebe30786843d77712e030b677bf0ca581

Analysis

max time kernel
147s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Size 336KB
Sample240709-nps8lateqa
SHA256 b2a9a9fcfcf83a0b9d6e8c44458a0fcebe30786843d77712e030b677bf0ca581
MD5 30351a1788cfb3c6d870b7ca49035662
SHA1 7c51397ebb4e872a489ac5d11667a674e4117a67
SHA512 44893aad6e4ae72c2d229f123497e7233e81f4f2250b5de37ca0ed626ca3edf7ebae84c1f17c4ed89c27fa3b59336707283eb4291b041a0b2a4412b5780d8f8f
SSDEEP 6144:lG78LjzOANvSAsQLqF9pXMiY3sGB6UduRfLtcR:U7kmAN6omFMb3sGB6UduRfLaR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

latentbot evasion persistence trojan

Malware Config

Extracted

Family

latentbot

microsoftserver.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\CTXG66YOQR.exe = "C:\\Users\\Admin\\AppData\\Roaming\\CTXG66YOQR.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\WindowsX32 = "C:\\Users\\Admin\\AppData\\Roaming\\CTXG66YOQR.exe"	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CDDBD61-CD7D-EC9B-DC7D-9DB1BABEEF0F}	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0CDDBD61-CD7D-EC9B-DC7D-9DB1BABEEF0F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\CTXG66YOQR.exe"	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{0CDDBD61-CD7D-EC9B-DC7D-9DB1BABEEF0F}	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{0CDDBD61-CD7D-EC9B-DC7D-9DB1BABEEF0F}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\CTXG66YOQR.exe"	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsX32 = "C:\\Users\\Admin\\AppData\\Roaming\\CTXG66YOQR.exe"	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-587429654-1855694383-2268796072-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsX32 = "C:\\Users\\Admin\\AppData\\Roaming\\CTXG66YOQR.exe"	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4404	reg.exe
5104	reg.exe
2952	reg.exe
3540	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeCreateTokenPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeAssignPrimaryTokenPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeMachineAccountPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeTcbPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeSecurityPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeSystemtimePrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeCreatePermanentPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeBackupPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeRestorePrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeShutdownPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeDebugPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeAuditPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeUndockPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeSyncAgentPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeEnableDelegationPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeManageVolumePrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeImpersonatePrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: 31	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: 32	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: 33	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: 34	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: 35	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
Token: SeDebugPrivilege	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 2640	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe	82
PID 216 wrote to memory of 2640	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe	82
PID 216 wrote to memory of 2640	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe	82
PID 216 wrote to memory of 3892	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe	83
PID 216 wrote to memory of 3892	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe	83
PID 216 wrote to memory of 3892	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe	83
PID 216 wrote to memory of 5092	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe	84
PID 216 wrote to memory of 5092	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe	84
PID 216 wrote to memory of 5092	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe	84
PID 216 wrote to memory of 4572	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe	85
PID 216 wrote to memory of 4572	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe	85
PID 216 wrote to memory of 4572	216	30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe	85
PID 5092 wrote to memory of 4404	5092	cmd.exe	90
PID 5092 wrote to memory of 4404	5092	cmd.exe	90
PID 5092 wrote to memory of 4404	5092	cmd.exe	90
PID 4572 wrote to memory of 2952	4572	cmd.exe	92
PID 4572 wrote to memory of 2952	4572	cmd.exe	92
PID 4572 wrote to memory of 2952	4572	cmd.exe	92
PID 2640 wrote to memory of 5104	2640	cmd.exe	91
PID 2640 wrote to memory of 5104	2640	cmd.exe	91
PID 2640 wrote to memory of 5104	2640	cmd.exe	91
PID 3892 wrote to memory of 3540	3892	cmd.exe	93
PID 3892 wrote to memory of 3540	3892	cmd.exe	93
PID 3892 wrote to memory of 3540	3892	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe"
1⤵
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - Modifies registry key
    PID:5104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\30351a1788cfb3c6d870b7ca49035662_JaffaCakes118.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - Modifies registry key
    PID:3540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - Modifies firewall policy service
    - Modifies registry key
    PID:4404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\CTXG66YOQR.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\CTXG66YOQR.exe:*:Enabled:Windows Messanger" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\CTXG66YOQR.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\CTXG66YOQR.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - Modifies firewall policy service
    - Modifies registry key
    PID:2952