latentbot | 43fc769fd2de10079f041fce51baff86c7b36f980ad8bcbeff2e24844f6260cd

General

Target

eedf4711947a16a368506025ea4705cf_JaffaCakes118.exe
Size

164KB
MD5

eedf4711947a16a368506025ea4705cf
SHA1

e18ed2d898f48df640f46324ae4a146beb8c8799
SHA256

43fc769fd2de10079f041fce51baff86c7b36f980ad8bcbeff2e24844f6260cd
SHA512

2ef36316381fc325843bed05dfcc6f94892ea99ee603b13910832bab076dfe7052ed72810070da6aeb2518344c8ad01fba207b4e109d9976df16280e55fd13b2
SSDEEP

3072:RVsZyTkmcEI6XKB2V1BIA43hKB2J7DIUIgJyj9vG5ib:RZTk7qKY/IhxWi7cUFMIE

Score

10^/10

latentbot modiloader discovery evasion trojan upx

Malware Config

Extracted

Family

latentbot

C2

yineyeniden.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Exporer32.exe

ModiLoader Second Stage 18 IoCs

resource	yara_rule
behavioral1/memory/2248-32-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-31-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-34-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-42-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-43-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-46-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-49-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-52-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-55-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-58-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-62-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-65-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-68-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-71-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-74-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-77-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-80-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2
behavioral1/memory/2248-83-0x0000000000400000-0x0000000000450000-memory.dmp	modiloader_stage2

Executes dropped EXE 2 IoCs

pid	Process
1916	Exporer32.exe
2248	Exporer32.exe

Loads dropped DLL 5 IoCs

pid	Process
1932	eedf4711947a16a368506025ea4705cf_JaffaCakes118.exe
1932	eedf4711947a16a368506025ea4705cf_JaffaCakes118.exe
1916	Exporer32.exe
2248	Exporer32.exe
2248	Exporer32.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2248-28-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-25-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-22-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-21-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-30-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-32-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-31-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-34-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-42-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-43-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-46-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-49-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-52-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-55-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-58-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-62-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-65-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-68-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-71-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-74-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-77-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-80-0x0000000000400000-0x0000000000450000-memory.dmp	upx
behavioral1/memory/2248-83-0x0000000000400000-0x0000000000450000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Exporer32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Exporer32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1916 set thread context of 2248	1916	Exporer32.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eedf4711947a16a368506025ea4705cf_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exporer32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exporer32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	Exporer32.exe
Token: SeBackupPrivilege	2872	vssvc.exe
Token: SeRestorePrivilege	2872	vssvc.exe
Token: SeAuditPrivilege	2872	vssvc.exe
Token: SeDebugPrivilege	2248	Exporer32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1932	eedf4711947a16a368506025ea4705cf_JaffaCakes118.exe
1932	eedf4711947a16a368506025ea4705cf_JaffaCakes118.exe
1916	Exporer32.exe
2248	Exporer32.exe
2248	Exporer32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1916	1932	eedf4711947a16a368506025ea4705cf_JaffaCakes118.exe	30
PID 1932 wrote to memory of 1916	1932	eedf4711947a16a368506025ea4705cf_JaffaCakes118.exe	30
PID 1932 wrote to memory of 1916	1932	eedf4711947a16a368506025ea4705cf_JaffaCakes118.exe	30
PID 1932 wrote to memory of 1916	1932	eedf4711947a16a368506025ea4705cf_JaffaCakes118.exe	30
PID 1916 wrote to memory of 2248	1916	Exporer32.exe	31
PID 1916 wrote to memory of 2248	1916	Exporer32.exe	31
PID 1916 wrote to memory of 2248	1916	Exporer32.exe	31
PID 1916 wrote to memory of 2248	1916	Exporer32.exe	31
PID 1916 wrote to memory of 2248	1916	Exporer32.exe	31
PID 1916 wrote to memory of 2248	1916	Exporer32.exe	31
PID 1916 wrote to memory of 2248	1916	Exporer32.exe	31
PID 1916 wrote to memory of 2248	1916	Exporer32.exe	31

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Exporer32.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\eedf4711947a16a368506025ea4705cf_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eedf4711947a16a368506025ea4705cf_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
  "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
    "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - System policy modification
    PID:2248

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Exporer32.exe

Filesize
140KB

MD5
75260627881d38e09d8fc5010152fc2d

SHA1
5f2fcc01425f90229c26444ef4f44c7a4dec4fc3

SHA256
b8da9b636ab7ead75d17c9855e8bb6c921c4ca0eff11bc78f4f23bf25d11f4ca

SHA512
77189749ec158ec5c96ddc292772b5a521ae95d57ee904e2fd9f89c45728265485d021e14cb792cb5e66eb0a0b2721aa02097df7df4943840c02f24b9914b879

Download Submit
\Users\Admin\AppData\Local\Temp\cmsetac.dll

Filesize
32KB

MD5
c200deb575126b97609d020897aaa5ac

SHA1
9d086f32f5e6a134c5a9dffe35d29c2a3261a42f

SHA256
a4a0c6545cd3990fcfb973ff5b76517520edf142d9f09fbcb118c92574ed2762

SHA512
c8040e3997967d4c25401b53b9fb97545709829876031cdd985c46cf0cccb467a546c8563441b2fbe2e03de0c9829732a345eb629e2eb2eecb87026794e4b7d7

Download Submit
\Users\Admin\AppData\Local\Temp\ntdtcstp.dll

Filesize
7KB

MD5
67587e25a971a141628d7f07bd40ffa0

SHA1
76fcd014539a3bb247cc0b761225f68bd6055f6b

SHA256
e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

SHA512
6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

Download Submit
memory/1916-29-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1932-12-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1932-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2248-40-0x0000000002830000-0x000000000283E000-memory.dmp

Filesize
56KB

Download
memory/2248-44-0x0000000000620000-0x0000000000628000-memory.dmp

Filesize
32KB

Download
memory/2248-21-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-25-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-30-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-32-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-31-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-33-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2248-34-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-19-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2248-28-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-42-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-43-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-45-0x0000000002830000-0x000000000283E000-memory.dmp

Filesize
56KB

Download
memory/2248-22-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-46-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-49-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-52-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-55-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-58-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-62-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-65-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-68-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-71-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-74-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-77-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-80-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2248-83-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads