latentbot | 8fa8658250cc2ad2d38231a4398bf4557e1696c9addfc8aa08d9acff15e09d80

General

Target

955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe
Size

290KB
MD5

955026d0cce01ca24e370fc92b191388
SHA1

a8ec01ebbc32e98c8d3b5e77046099a13568c2f3
SHA256

8fa8658250cc2ad2d38231a4398bf4557e1696c9addfc8aa08d9acff15e09d80
SHA512

07ad433cc4b7f55a42bcf892291e1b1f6b7e6c5900458aeb49c3d732ee405f3469f52151248dd11f53cf7b685a8be1072a0eaef7457cef2ff9a1307e0b0c885f
SSDEEP

6144:OgSEOvlo2IDz1gVMlsOjrf1uXrJCoazgu/YuJdZb/7xFz+hfiRhz5TeboX:OCOvlo2xVksOrfExu/Zxb/n8QHO+

Score

10^/10

latentbot discovery persistence trojan

Malware Config

Extracted

Family

latentbot

C2

emmanuelisay.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68C7BDA9-A9DF-448D-8D14-8C4A7374CC62}	server.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{68C7BDA9-A9DF-448D-8D14-8C4A7374CC62}\StubPath = "C:\\Windows\\SysWOW64\\server.exe"	server.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2828	server.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\server.exe	955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\server.exe	955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\melt.bat	955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 2828	3992	955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe	94
PID 3992 wrote to memory of 2828	3992	955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe	94
PID 3992 wrote to memory of 2828	3992	955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe	94
PID 3992 wrote to memory of 3588	3992	955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe	95
PID 3992 wrote to memory of 3588	3992	955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe	95
PID 3992 wrote to memory of 3588	3992	955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\955026d0cce01ca24e370fc92b191388_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\SysWOW64\server.exe
  "C:\Windows\System32\server.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\melt.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4152,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\melt.bat

Filesize
128B

MD5
51840d4900dfa0b457cb4ad1f5fd5519

SHA1
8167f5a6f0ff29bc41c8de099ff6f52d4a2ccc24

SHA256
86f07478c6d8759139aa71231047df9023ec6fb83dc896c29ccaae3dcdcb5e3a

SHA512
20587e631f06da351b61aeec3a6ba351a4e2dbb285b056e7228095ad8f03ef286105d4da576892ee17f848d644b449b5752c24adc91afa7101a5bcb248d1e563

Download Submit
C:\Windows\SysWOW64\server.exe

Filesize
290KB

MD5
955026d0cce01ca24e370fc92b191388

SHA1
a8ec01ebbc32e98c8d3b5e77046099a13568c2f3

SHA256
8fa8658250cc2ad2d38231a4398bf4557e1696c9addfc8aa08d9acff15e09d80

SHA512
07ad433cc4b7f55a42bcf892291e1b1f6b7e6c5900458aeb49c3d732ee405f3469f52151248dd11f53cf7b685a8be1072a0eaef7457cef2ff9a1307e0b0c885f

Download Submit
memory/2828-13-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3992-11-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads