Overview

overview

10

Static

static

3

bf731bb4cf...18.exe

windows7-x64

10

bf731bb4cf...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf731bb4cf8fc8724c08864334e138a3_JaffaCakes118

  • Size

    813KB

  • Sample

    240824-1bkera1akc

  • MD5

    bf731bb4cf8fc8724c08864334e138a3

  • SHA1

    2fd67abed797cbcb916125cb9d792f82cbad1d34

  • SHA256

    5dc147d924897e4952e97d7724a9d401c1036bd37f6e6045e8251ff675599beb

  • SHA512

    0a3ecd7f719f1b0b6097b686c73a5ae45ee5a7c874fcbfd89bb2e4d833ffd488738bf8704af580835ae228dc97b80f0a225c6b69d16e7d290ea198785d45c563

  • SSDEEP

    12288:IlsKXp4DADHq8v/t43wJHFDhmS/ymmHcSrU0Qn7bcR0GYeATgUhVnRIF:41XptDHLuw1Nb/p93Rn3cR89MUhxRI

Score
10/10
latentbotdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

latentbot

C2

terranostra.zapto.org

Targets

    • Target

      bf731bb4cf8fc8724c08864334e138a3_JaffaCakes118

    • Size

      813KB

    • MD5

      bf731bb4cf8fc8724c08864334e138a3

    • SHA1

      2fd67abed797cbcb916125cb9d792f82cbad1d34

    • SHA256

      5dc147d924897e4952e97d7724a9d401c1036bd37f6e6045e8251ff675599beb

    • SHA512

      0a3ecd7f719f1b0b6097b686c73a5ae45ee5a7c874fcbfd89bb2e4d833ffd488738bf8704af580835ae228dc97b80f0a225c6b69d16e7d290ea198785d45c563

    • SSDEEP

      12288:IlsKXp4DADHq8v/t43wJHFDhmS/ymmHcSrU0Qn7bcR0GYeATgUhVnRIF:41XptDHLuw1Nb/p93Rn3cR89MUhxRI

    Score
    10/10
    latentbotdefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

      trojanlatentbot

    • Modifies firewall policy service

      evasion

    • Modifies security service

      evasion

    • Modifies Windows Firewall

      evasion

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Modifies WinLogon

      persistence

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Drops file in System32 directory

    • Hide Artifacts: Hidden Users

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Hide Artifacts

1
T1564

Hidden Users

1
T1564.002

Impair Defenses

2
T1562

Disable or Modify System Firewall

2
T1562.004

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

4
T1112

Credential Access

Discovery

Network Share Discovery

1
T1135

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks