latentbot | 68a93828ffbba9ddc3a7a493c909b212af0c2184ab2a96040a13b88e1ea2be8a

Analysis

max time kernel
148s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3cf91b6cf1dd24a262ee65a66067dac9_JaffaCakes118.exe
Size 1.2MB
Sample241013-bfpsla1dkf
SHA256 68a93828ffbba9ddc3a7a493c909b212af0c2184ab2a96040a13b88e1ea2be8a
MD5 3cf91b6cf1dd24a262ee65a66067dac9
SHA1 02b32bb0460c10b4050c2e97592a5c8971729935
SHA512 ad839c6718203f8694004450c758f7a14a38da8cb5996d034997c4f55cea947cd94fbfa3265e261625263e527658bd47948d462d630fec890e96704fb325b3c2
SSDEEP 24576:kRmJkcoQricOIQxiZY1WNi/NvDAFE7EMuoKqgvWNEWixOgwDwRaYO:hJZoQrbTFZY1WNiZEW7EMbwvjdLwDw8X
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

latentbot discovery evasion trojan

Malware Config

Extracted

Family

latentbot

afflictionrat2.zapto.org
1afflictionrat2.zapto.org
2afflictionrat2.zapto.org
3afflictionrat2.zapto.org
4afflictionrat2.zapto.org
5afflictionrat2.zapto.org
6afflictionrat2.zapto.org
7afflictionrat2.zapto.org
8afflictionrat2.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\explorer.exe = "C:\\Windows\\SysWOW64\\explorer.exe:*:Enabled:Windows Messanger"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\7Z2WW37IAO2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\7Z2WW37IAO2.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4928-0-0x0000000000400000-0x00000000004CE000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4928 set thread context of 1968	4928	3cf91b6cf1dd24a262ee65a66067dac9_JaffaCakes118.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3cf91b6cf1dd24a262ee65a66067dac9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1848	reg.exe
3608	reg.exe
1448	reg.exe
2004	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: 1	1968	explorer.exe
Token: SeCreateTokenPrivilege	1968	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	1968	explorer.exe
Token: SeLockMemoryPrivilege	1968	explorer.exe
Token: SeIncreaseQuotaPrivilege	1968	explorer.exe
Token: SeMachineAccountPrivilege	1968	explorer.exe
Token: SeTcbPrivilege	1968	explorer.exe
Token: SeSecurityPrivilege	1968	explorer.exe
Token: SeTakeOwnershipPrivilege	1968	explorer.exe
Token: SeLoadDriverPrivilege	1968	explorer.exe
Token: SeSystemProfilePrivilege	1968	explorer.exe
Token: SeSystemtimePrivilege	1968	explorer.exe
Token: SeProfSingleProcessPrivilege	1968	explorer.exe
Token: SeIncBasePriorityPrivilege	1968	explorer.exe
Token: SeCreatePagefilePrivilege	1968	explorer.exe
Token: SeCreatePermanentPrivilege	1968	explorer.exe
Token: SeBackupPrivilege	1968	explorer.exe
Token: SeRestorePrivilege	1968	explorer.exe
Token: SeShutdownPrivilege	1968	explorer.exe
Token: SeDebugPrivilege	1968	explorer.exe
Token: SeAuditPrivilege	1968	explorer.exe
Token: SeSystemEnvironmentPrivilege	1968	explorer.exe
Token: SeChangeNotifyPrivilege	1968	explorer.exe
Token: SeRemoteShutdownPrivilege	1968	explorer.exe
Token: SeUndockPrivilege	1968	explorer.exe
Token: SeSyncAgentPrivilege	1968	explorer.exe
Token: SeEnableDelegationPrivilege	1968	explorer.exe
Token: SeManageVolumePrivilege	1968	explorer.exe
Token: SeImpersonatePrivilege	1968	explorer.exe
Token: SeCreateGlobalPrivilege	1968	explorer.exe
Token: 31	1968	explorer.exe
Token: 32	1968	explorer.exe
Token: 33	1968	explorer.exe
Token: 34	1968	explorer.exe
Token: 35	1968	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1968	explorer.exe
1968	explorer.exe
1968	explorer.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1968	4928	3cf91b6cf1dd24a262ee65a66067dac9_JaffaCakes118.exe	86
PID 4928 wrote to memory of 1968	4928	3cf91b6cf1dd24a262ee65a66067dac9_JaffaCakes118.exe	86
PID 4928 wrote to memory of 1968	4928	3cf91b6cf1dd24a262ee65a66067dac9_JaffaCakes118.exe	86
PID 4928 wrote to memory of 1968	4928	3cf91b6cf1dd24a262ee65a66067dac9_JaffaCakes118.exe	86
PID 4928 wrote to memory of 1968	4928	3cf91b6cf1dd24a262ee65a66067dac9_JaffaCakes118.exe	86
PID 1968 wrote to memory of 1076	1968	explorer.exe	87
PID 1968 wrote to memory of 1076	1968	explorer.exe	87
PID 1968 wrote to memory of 1076	1968	explorer.exe	87
PID 1968 wrote to memory of 1516	1968	explorer.exe	88
PID 1968 wrote to memory of 1516	1968	explorer.exe	88
PID 1968 wrote to memory of 1516	1968	explorer.exe	88
PID 1968 wrote to memory of 848	1968	explorer.exe	89
PID 1968 wrote to memory of 848	1968	explorer.exe	89
PID 1968 wrote to memory of 848	1968	explorer.exe	89
PID 1968 wrote to memory of 3460	1968	explorer.exe	90
PID 1968 wrote to memory of 3460	1968	explorer.exe	90
PID 1968 wrote to memory of 3460	1968	explorer.exe	90
PID 1076 wrote to memory of 1848	1076	cmd.exe	95
PID 1076 wrote to memory of 1848	1076	cmd.exe	95
PID 1076 wrote to memory of 1848	1076	cmd.exe	95
PID 848 wrote to memory of 1448	848	cmd.exe	96
PID 848 wrote to memory of 1448	848	cmd.exe	96
PID 848 wrote to memory of 1448	848	cmd.exe	96
PID 3460 wrote to memory of 3608	3460	cmd.exe	97
PID 3460 wrote to memory of 3608	3460	cmd.exe	97
PID 3460 wrote to memory of 3608	3460	cmd.exe	97
PID 1516 wrote to memory of 2004	1516	cmd.exe	98
PID 1516 wrote to memory of 2004	1516	cmd.exe	98
PID 1516 wrote to memory of 2004	1516	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\3cf91b6cf1dd24a262ee65a66067dac9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3cf91b6cf1dd24a262ee65a66067dac9_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\SysWOW64\explorer.exe" /t REG_SZ /d "C:\Windows\SysWOW64\explorer.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\SysWOW64\explorer.exe" /t REG_SZ /d "C:\Windows\SysWOW64\explorer.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:1448
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\7Z2WW37IAO2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7Z2WW37IAO2.exe:*:Enabled:Windows Messanger" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\7Z2WW37IAO2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\7Z2WW37IAO2.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Modifies firewall policy service
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:3608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut9F7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut9F7C.tmp
Size 420KB
SHA256 eb709887daad154802fdaff677d89aaabe3333683c7eb6e8963406e4bef25101
MD5 8c23f4e4b2cea7f3a6829f358caa29a2
SHA1 fdead950e913085753b56f022048afdb872645fa
SHA512 90853b11b969ee25087e83b005043fbc7a990ffe740ec4b9fbdfd56fa1c06b23e5a0b85921485fb7084be60eca5d1bcada3b2a3816b563bb263fa63bc058e632
SSDEEP 12288:slAuD9nC2hUPO84Y7DFeEOlogCpWwmgJOio/e:OBbhUWlGDFeEf9ySw/e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1968-9-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1968-11-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/1968-22-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/4928-0-0x0000000000400000-0x00000000004CE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads