General

  • Target

    BillDetails.exe

  • Size

    3.9MB

  • Sample

    241009-x36waascnq

  • MD5

    f9fdaa73953ce9a148bc4b465ab1408f

  • SHA1

    a2f259b8f8ddfae8994eb8200b8d89c256ddc13d

  • SHA256

    0f6c99a0e331ab6eae07a1d98a80d839f8c2e025bd17a587a6c5eead001acc38

  • SHA512

    889440392c11a0de283d6bf32ec4ba2c3e9aca463b7f96562815e1c2e06b1fe1f0a719896bfbb158ca7c1d557120fa73c82576f987ac76b28a0b8e598c111466

  • SSDEEP

    98304:6tlEb9+zykLmOCYNW/WrHwOnvE8sJXcMv5ezs2rEPqtxLA:6tSb9+zykLmxd/cHwOkp7uA

Malware Config

Extracted

Family

latentbot

C2

besthard2024.zapto.org

Targets

    • Target

      BillDetails.exe

    • Size

      3.9MB

    • MD5

      f9fdaa73953ce9a148bc4b465ab1408f

    • SHA1

      a2f259b8f8ddfae8994eb8200b8d89c256ddc13d

    • SHA256

      0f6c99a0e331ab6eae07a1d98a80d839f8c2e025bd17a587a6c5eead001acc38

    • SHA512

      889440392c11a0de283d6bf32ec4ba2c3e9aca463b7f96562815e1c2e06b1fe1f0a719896bfbb158ca7c1d557120fa73c82576f987ac76b28a0b8e598c111466

    • SSDEEP

      98304:6tlEb9+zykLmOCYNW/WrHwOnvE8sJXcMv5ezs2rEPqtxLA:6tSb9+zykLmxd/cHwOkp7uA

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Use of msiexec (install) with remote resource

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks