latentbot | afb976855a579c48d62c6ae4ea7e2c52b7c9a651c25ae999c38cac1f10b16a06

General

Target

5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe
Size

262KB
MD5

5b46786e8b21decf3c37cd22683d79f9
SHA1

8e30e3313ad2149959ba4c4eb6a4652afb140413
SHA256

afb976855a579c48d62c6ae4ea7e2c52b7c9a651c25ae999c38cac1f10b16a06
SHA512

00c791eff9a69d7b249d3b1bd2f8aa6095a8380f24e20c85cf20154dc747d51a5380fa6b6a77d37704ae7308b04f0b412c900cf395d9164a0407dcb62fe88228
SSDEEP

6144:WZANI8hAiQIPClbtwdGd2mJjzDNwAAzQ9:7C8hqtwde2m5P6tzO

Score

10^/10

latentbot modiloader evasion persistence trojan

Malware Config

Extracted

Family

latentbot

C2

kankabengeldim.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

ModiLoader Second Stage 16 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023355-22.dat	modiloader_stage2
behavioral2/memory/2716-35-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-49-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-52-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-55-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-58-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-61-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-64-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-67-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-70-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-73-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-76-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-79-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-82-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-85-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2
behavioral2/memory/4488-88-0x0000000000400000-0x000000000044B000-memory.dmp	modiloader_stage2

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	g.exe
Key value queried	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation	Exporer32.exe

Executes dropped EXE 3 IoCs

pid	Process
4176	g.exe
2716	Exporer32.exe
4488	mstwain32.exe

Loads dropped DLL 4 IoCs

pid	Process
4488	mstwain32.exe
4488	mstwain32.exe
4488	mstwain32.exe
4488	mstwain32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstwain32 = "C:\\Windows\\mstwain32.exe"	mstwain32.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Exporer32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstwain32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\g.exe	g.exe
File created	C:\Windows\mstwain32.exe	Exporer32.exe
File opened for modification	C:\Windows\mstwain32.exe	Exporer32.exe
File created	C:\Windows\ntdtcstp.dll	mstwain32.exe
File created	C:\Windows\cmsetac.dll	mstwain32.exe
File opened for modification	C:\Windows\g.exe	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe
File opened for modification	C:\Windows\Yeni Metin Belgesi (2).txt	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2716	Exporer32.exe
Token: SeBackupPrivilege	4116	vssvc.exe
Token: SeRestorePrivilege	4116	vssvc.exe
Token: SeAuditPrivilege	4116	vssvc.exe
Token: SeDebugPrivilege	4488	mstwain32.exe
Token: SeDebugPrivilege	4488	mstwain32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
788	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe
4176	g.exe
4488	mstwain32.exe
4488	mstwain32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 4176	788	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	86
PID 788 wrote to memory of 4176	788	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	86
PID 788 wrote to memory of 4176	788	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	86
PID 788 wrote to memory of 4704	788	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	87
PID 788 wrote to memory of 4704	788	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	87
PID 788 wrote to memory of 4704	788	5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe	87
PID 4176 wrote to memory of 2716	4176	g.exe	91
PID 4176 wrote to memory of 2716	4176	g.exe	91
PID 4176 wrote to memory of 2716	4176	g.exe	91
PID 2716 wrote to memory of 4488	2716	Exporer32.exe	98
PID 2716 wrote to memory of 4488	2716	Exporer32.exe	98
PID 2716 wrote to memory of 4488	2716	Exporer32.exe	98

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	mstwain32.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5b46786e8b21decf3c37cd22683d79f9_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\g.exe
  "C:\Windows\g.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
    "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\mstwain32.exe
      "C:\Windows\mstwain32.exe" \melt "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
      4⤵
      UAC bypass
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Checks whether UAC is enabled
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:4488
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\Yeni Metin Belgesi (2).txt
  2⤵
  PID:4704

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Exporer32.exe

Filesize
270KB

MD5
fc90d8ae20f2c14cc518edca431cc7b3

SHA1
03df6390704e326fdc18bdf652a608e5f43a351e

SHA256
1cd6017fd5af8b263eff4afda82bc5024e37e0a2bd8e2458e61361e99ab94652

SHA512
94d902bba8f3721cb3bb99f5845e9d75d6955172683cca9933576b06d17af9b93cda24a2aeb23f22453b4925c791bb20773fd2a696c181b054d3424977d03587

Download Submit
C:\Windows\Yeni Metin Belgesi (2).txt

Filesize
46B

MD5
a43de9356fac163413c46fb24bf2f031

SHA1
f1f8ff5f7a963fda13e91d96929265611c8d6e12

SHA256
b94797eb71b4f4e029070ea1a5976b76cf08606571436399e539921946c5eaf5

SHA512
987d8158eb0f94160da8d1c316ec0c9820467784d8f5448834026f09fa40588dd3f5f4bbfc1fdaa96c2799b553e936efc9d96db903e03b004ebd16004ed715ca

Download Submit
C:\Windows\cmsetac.dll

Filesize
33KB

MD5
c8837e079f802243d96e588569262bab

SHA1
fe536bb7d03acf8cec171dc2fad24a236eb038a9

SHA256
3a542d77d831aa1215779c91fac3e0f414c40ed7e90e6bf4b07e8688c5f1d2b0

SHA512
a626af7e6de0275f2a4e5358ca95035d5588a9a8c04e812a3f2a16a159f24ab29b6be4b57a1c31969517fb5df44c803ad3700f7fcebcf05734773d1a9621f8c3

Download Submit
C:\Windows\g.exe

Filesize
290KB

MD5
ca9705b28cada5398c05fb43e3d0c041

SHA1
d839bc23fa6afa1751efd0d68a549a52e8bd81ee

SHA256
321b24a64016a855c3f921cf1bdcf7de70d0afdcc197ad3f0f0966fcb909dad4

SHA512
0b61113fa34bad62dc3ffd107887752e99caf698dea9d97b2e1ba73608374c02174251d28a7cdf58ec5fb4a294e904fd6962cbfceb5c378ce0060da6dde1a4ae

Download Submit
C:\Windows\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/2716-35-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-52-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-67-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-51-0x00000000023E0000-0x00000000023EE000-memory.dmp

Filesize
56KB

Download
memory/4488-50-0x0000000000730000-0x0000000000738000-memory.dmp

Filesize
32KB

Download
memory/4488-46-0x00000000023E0000-0x00000000023EE000-memory.dmp

Filesize
56KB

Download
memory/4488-55-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-58-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-61-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-64-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-49-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-70-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-73-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-76-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-79-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-82-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-85-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/4488-88-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads