latentbot | afb976855a579c48d62c6ae4ea7e2c52b7c9a651c25ae999c38cac1f10b16a06

General

Target

5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe
Size

262KB
MD5

5b46786e8b21decf3c37cd22683d79f9
SHA1

8e30e3313ad2149959ba4c4eb6a4652afb140413
SHA256

afb976855a579c48d62c6ae4ea7e2c52b7c9a651c25ae999c38cac1f10b16a06
SHA512

00c791eff9a69d7b249d3b1bd2f8aa6095a8380f24e20c85cf20154dc747d51a5380fa6b6a77d37704ae7308b04f0b412c900cf395d9164a0407dcb62fe88228
SSDEEP

6144:WZANI8hAiQIPClbtwdGd2mJjzDNwAAzQ9:7C8hqtwde2m5P6tzO

Score

10^/10

latentbot modiloader evasion persistence trojan

Malware Config

Extracted

Family

latentbot

C2

kankabengeldim.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 16 IoCs

resource	yara_rule
behavioral1/files/0x0009000000015cf8-16.dat	modiloader_stage2
behavioral1/memory/2200-33-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-39-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-42-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-45-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-48-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-51-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-55-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-58-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-61-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-64-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-67-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-70-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-73-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-76-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral1/memory/2900-79-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2

Executes dropped EXE 3 IoCs

pid	Process
2528	g.exe
2200	Exporer32.exe
2900	mstwain32.exe

Loads dropped DLL 3 IoCs

pid	Process
2528	g.exe
2528	g.exe
2200	Exporer32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Exporer32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Yeni Metin Belgesi (2).txt	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe
File opened for modification	C:\Windows\g.exe	g.exe
File created	C:\Windows\mstwain32.exe	Exporer32.exe
File opened for modification	C:\Windows\mstwain32.exe	Exporer32.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe
File opened for modification	C:\Windows\g.exe	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2200	Exporer32.exe
Token: SeBackupPrivilege	2316	vssvc.exe
Token: SeRestorePrivilege	2316	vssvc.exe
Token: SeAuditPrivilege	2316	vssvc.exe
Token: SeDebugPrivilege	2900	mstwain32.exe
Token: SeDebugPrivilege	2900	mstwain32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2176	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe
2528	g.exe
2900	mstwain32.exe
2900	mstwain32.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2528	2176	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2528	2176	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2528	2176	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2528	2176	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2552	2176	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2552	2176	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2552	2176	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2552	2176	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	31
PID 2528 wrote to memory of 2200	2528	g.exe	32
PID 2528 wrote to memory of 2200	2528	g.exe	32
PID 2528 wrote to memory of 2200	2528	g.exe	32
PID 2528 wrote to memory of 2200	2528	g.exe	32
PID 2200 wrote to memory of 2900	2200	Exporer32.exe	37
PID 2200 wrote to memory of 2900	2200	Exporer32.exe	37
PID 2200 wrote to memory of 2900	2200	Exporer32.exe	37
PID 2200 wrote to memory of 2900	2200	Exporer32.exe	37

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\g.exe
  "C:\Windows\g.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
    "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\mstwain32.exe
      "C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:2900
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\Yeni Metin Belgesi (2).txt
  2⤵
  PID:2552

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Yeni Metin Belgesi (2).txt

Filesize
46B

MD5
a43de9356fac163413c46fb24bf2f031

SHA1
f1f8ff5f7a963fda13e91d96929265611c8d6e12

SHA256
b94797eb71b4f4e029070ea1a5976b76cf08606571436399e539921946c5eaf5

SHA512
987d8158eb0f94160da8d1c316ec0c9820467784d8f5448834026f09fa40588dd3f5f4bbfc1fdaa96c2799b553e936efc9d96db903e03b004ebd16004ed715ca

Download Submit
C:\Windows\g.exe

Filesize
290KB

MD5
ca9705b28cada5398c05fb43e3d0c041

SHA1
d839bc23fa6afa1751efd0d68a549a52e8bd81ee

SHA256
321b24a64016a855c3f921cf1bdcf7de70d0afdcc197ad3f0f0966fcb909dad4

SHA512
0b61113fa34bad62dc3ffd107887752e99caf698dea9d97b2e1ba73608374c02174251d28a7cdf58ec5fb4a294e904fd6962cbfceb5c378ce0060da6dde1a4ae

Download Submit
\Users\Admin\AppData\Local\Temp\Exporer32.exe

Filesize
270KB

MD5
fc90d8ae20f2c14cc518edca431cc7b3

SHA1
03df6390704e326fdc18bdf652a608e5f43a351e

SHA256
1cd6017fd5af8b263eff4afda82bc5024e37e0a2bd8e2458e61361e99ab94652

SHA512
94d902bba8f3721cb3bb99f5845e9d75d6955172683cca9933576b06d17af9b93cda24a2aeb23f22453b4925c791bb20773fd2a696c181b054d3424977d03587

Download Submit
memory/2200-33-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-48-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-58-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-40-0x0000000000250000-0x0000000000258000-memory.dmp

Filesize
32KB

Download
memory/2900-41-0x00000000004E0000-0x00000000004EE000-memory.dmp

Filesize
56KB

Download
memory/2900-42-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-45-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-37-0x00000000004E0000-0x00000000004EE000-memory.dmp

Filesize
56KB

Download
memory/2900-51-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-55-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-39-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-61-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-64-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-67-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-70-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-73-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-76-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2900-79-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads