latentbot | 98f5bfa08294dc8ed3d342cae3c29406976a2272d8aba21222b636f420e1d6a1

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8256b9d70f90c9df0a72e1e9df7a9520_JaffaCakes118.exe
Size 1.5MB
Sample240802-atj9lazbmd
SHA256 98f5bfa08294dc8ed3d342cae3c29406976a2272d8aba21222b636f420e1d6a1
MD5 8256b9d70f90c9df0a72e1e9df7a9520
SHA1 f3ab1dd95eb9efad5432797117a3574e66ecfb71
SHA512 b314646c7baa414c75e8ae07a23161ae1b7073c6be5a7c0631d39f84c7ef18254eb6d8d9c376ccfe0eb39fadac3c6304dbaf34dc4260fa0ad8e37448563176c8
SSDEEP 49152:lUGEBRAokFtqpukfcpTpW77qkGeLelPh7LrgEy:lbORnkrqpukfATpWqeLeRNLrS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

latentbot discovery persistence trojan

Malware Config

Extracted

Family

latentbot

yeniceriler.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation	8256b9d70f90c9df0a72e1e9df7a9520_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\Control Panel\International\Geo\Nation	scrss.exe

Executes dropped EXE 3 IoCs

pid	Process
2456	setup.exe
3236	hell koxp v1833.exe
4264	scrss.exe

Loads dropped DLL 4 IoCs

pid	Process
4264	scrss.exe
4264	scrss.exe
3236	hell koxp v1833.exe
3236	hell koxp v1833.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2927035347-1736702767-189270196-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scrss = "\"C:\\Users\\Admin\\AppData\\Local\\scrss.exe \""	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8256b9d70f90c9df0a72e1e9df7a9520_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hell koxp v1833.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4996	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2456	setup.exe
2456	setup.exe
4264	scrss.exe
4264	scrss.exe
4264	scrss.exe
4264	scrss.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3236	hell koxp v1833.exe
4264	scrss.exe
3236	hell koxp v1833.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 2456	4148	8256b9d70f90c9df0a72e1e9df7a9520_JaffaCakes118.exe	86
PID 4148 wrote to memory of 2456	4148	8256b9d70f90c9df0a72e1e9df7a9520_JaffaCakes118.exe	86
PID 4148 wrote to memory of 2456	4148	8256b9d70f90c9df0a72e1e9df7a9520_JaffaCakes118.exe	86
PID 2456 wrote to memory of 3236	2456	setup.exe	87
PID 2456 wrote to memory of 3236	2456	setup.exe	87
PID 2456 wrote to memory of 3236	2456	setup.exe	87
PID 2456 wrote to memory of 4264	2456	setup.exe	88
PID 2456 wrote to memory of 4264	2456	setup.exe	88
PID 2456 wrote to memory of 4264	2456	setup.exe	88
PID 4264 wrote to memory of 3068	4264	scrss.exe	89
PID 4264 wrote to memory of 3068	4264	scrss.exe	89
PID 4264 wrote to memory of 3068	4264	scrss.exe	89
PID 3068 wrote to memory of 3188	3068	cmd.exe	91
PID 3068 wrote to memory of 3188	3068	cmd.exe	91
PID 3068 wrote to memory of 3188	3068	cmd.exe	91
PID 3188 wrote to memory of 4996	3188	cmd.exe	92
PID 3188 wrote to memory of 4996	3188	cmd.exe	92
PID 3188 wrote to memory of 4996	3188	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\8256b9d70f90c9df0a72e1e9df7a9520_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8256b9d70f90c9df0a72e1e9df7a9520_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Roaming\Microsoft\setup.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Users\Admin\AppData\Local\hell koxp v1833.exe
    "C:\Users\Admin\AppData\Local\hell koxp v1833.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3236
- - C:\Users\Admin\AppData\Local\scrss.exe
    "C:\Users\Admin\AppData\Local\scrss.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V scrss /D "\"C:\Users\Admin\AppData\Local\scrss.exe \"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3188
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V scrss /D "\"C:\Users\Admin\AppData\Local\scrss.exe \"" /f
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

run.bat

Path C:\Users\Admin\AppData\Local\Temp\run.bat
Size 141B
SHA256 c5d8cfcd50c0a777ec07376edcb4a80b2e22bb8d115c2d2f5718022fb78e82d9
MD5 c43bd7836a8cf448f69638e14889ace4
SHA1 b7cdd6cabefdecad0f27f0c56215661e3fe2bb60
SHA512 077301b1326b81e6069d66e7ddf6605809b74db34a4b131994089bd49787d172052e70ee980b66915bf665385355a80da6a5981bc5f1971b74145f499e73adf2
MD5 SHA1 SHA512

Submit Download

hell koxp v1833.exe

Path C:\Users\Admin\AppData\Local\hell koxp v1833.exe
Size 100KB
SHA256 4397485a59ffe7dbd98491c5544e19d43f262663c8be15a02bac4d020c4cee28
MD5 9046c9a85e2cca9e7772631aa7cb0897
SHA1 eb094d4d62b9b52ba500823d5d9901cd4a3ecbc0
SHA512 46e73523f7a38db8eb157e83fc933f809862ac20dc2a447dd8e56f828c40b411a29516bac9ecfdc09bee9d0dbcff84dc7098a544d8a0640aad7eedf9be6e9c14
SSDEEP 1536:FzxShSzMtd9fMFLZq1dcMT+zxnMIXUA4RporKjm5KJwD76YMDXzx:F1ShSzMtd9fWq12H1B4RpLm5KifRsX1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntldr.dll

Path C:\Users\Admin\AppData\Local\ntldr.dll
Size 238KB
SHA256 1bfe346c455fa962ef1113b0ab6915a4b290ddaad7618c94caa8a3f17e2be71e
MD5 8380322522bb509450441bfd9eb341be
SHA1 6e72ee00e97d26bd62d956f87d5a8e83fa70104a
SHA512 7faa191d0750408db656762f9a98ec56968a88a3c8672b7135576544c67d76370e85634604e3b8d35b2d64ff2a7cfbac75f8f22ee900ba25b957ca1123071c5e
SSDEEP 6144:BlltRnSouLJR3pHKdMoaQRCkiqdfEWj6o3/:9tlS3L50CV8EW9
MD5 SHA1 SHA512 SSDEEP

Submit Download

scrss.exe

Path C:\Users\Admin\AppData\Local\scrss.exe
Size 444KB
SHA256 29942edd22b484ba3f6d597e5d38c44272476de6d7fb6f525cf09e247cd1e9e5
MD5 25608cff73c670b09bf408c82c97439c
SHA1 3e964cb75ea63a5751016ff3517b7ad9591ada36
SHA512 d23476d4c7bc9f99c9214065c2fe89626c772d92c102dfb9b9dd18e9f039b05712ac5a32dac4780b55b7b5c2b35591c3f36614718dfae087da0b6b2d0696625e
SSDEEP 12288:joaN23kS3G1WmQTQsD7azoM7kDMIwXOiZPTJ:tzCG1WmQTQCW7kDM5+2
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\setup.exe
Size 1.0MB
SHA256 bf428f058b272800cec5bb24f10298c9264f36f10c29d6c8e58a3bdd12641b42
MD5 a141bf6a16c06dccabe0c1e523f74a2f
SHA1 f0dca64f1dfd9a8b1dd7ae154dce5f47291a6c56
SHA512 6cea71be7cbdf24c08afd2decac5293a4e687f26b2426792fbaea83696ac7e4a04d000cffb29a2aca76aee6f360801cdc95ed1acd13119b42b54aed22d89bff8
SSDEEP 24576:AVkL/RWmQXtcLOCqkOgU3L5fm3azCG1WmQTQCW7kDM5+2A:AaytcL29Q3mrTe2A
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2456-30-0x0000000000400000-0x0000000000511000-memory.dmp

Download

memory/3236-42-0x0000000002980000-0x00000000029C0000-memory.dmp

Download

memory/3236-44-0x0000000002980000-0x00000000029C0000-memory.dmp

Download

memory/4148-9-0x0000000004000000-0x0000000004193000-memory.dmp

Download

memory/4148-0-0x00000000022A0000-0x00000000022A1000-memory.dmp

Download

memory/4264-36-0x00000000004F0000-0x0000000000530000-memory.dmp

Download

memory/4264-45-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4264-46-0x00000000004F0000-0x0000000000530000-memory.dmp

Download