latentbot | 96f6a0d2a2c0103b735cb140e05602097b2e03951fffbc891ec09b9fe48a77e9

Analysis

max time kernel
142s
max time network
155s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BLOCKBUSTER.exe
Size

9.1MB
MD5

74d3f521a38b23cd25ed61e4f8d99f16
SHA1

c4cd0e519aeca41e94665f2c5ea60a322deb3680
SHA256

1d822b3faabb8f65fc30076d32a95757a2c369ccb64ae54572e9f562280ae845
SHA512

ec1c8b0eb895fd8947cad6126abc5bca3a712e42475228b9dcb3496098e720abb83d4cba4621edbd8d3ad7f306a5f57ced9c2c98fe2c2d0c8ebbbf99d7faf0f1
SSDEEP

196608:bmFQso3Id5AypjCIN325pMKhQaLh6sOo5LZvqy1f:OQseId5AyZIpMKVLhJtJqS

Score

10^/10

latentbot discovery evasion persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exe

pid	Process
2408	netsh.exe

Loads dropped DLL 1 IoCs

Processes:

BLOCKBUSTER.exe

pid	Process
392	BLOCKBUSTER.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

SCHTASKS.execmd.execmd.exeschtasks.exenetsh.execmd.exeipconfig.exeBLOCKBUSTER.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BLOCKBUSTER.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

Processes:

ipconfig.exe

pid	Process
3044	ipconfig.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
2312	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

BLOCKBUSTER.exe

pid	Process
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

BLOCKBUSTER.exe

pid	Process
392	BLOCKBUSTER.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

BLOCKBUSTER.exe

pid	Process
392	BLOCKBUSTER.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

BLOCKBUSTER.exe

pid	Process
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe
392	BLOCKBUSTER.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

BLOCKBUSTER.execmd.execmd.execmd.exe

description	pid	Process	procid_target
PID 392 wrote to memory of 1184	392	BLOCKBUSTER.exe	29
PID 392 wrote to memory of 1184	392	BLOCKBUSTER.exe	29
PID 392 wrote to memory of 1184	392	BLOCKBUSTER.exe	29
PID 392 wrote to memory of 1184	392	BLOCKBUSTER.exe	29
PID 392 wrote to memory of 2944	392	BLOCKBUSTER.exe	31
PID 392 wrote to memory of 2944	392	BLOCKBUSTER.exe	31
PID 392 wrote to memory of 2944	392	BLOCKBUSTER.exe	31
PID 392 wrote to memory of 2944	392	BLOCKBUSTER.exe	31
PID 392 wrote to memory of 2948	392	BLOCKBUSTER.exe	32
PID 392 wrote to memory of 2948	392	BLOCKBUSTER.exe	32
PID 392 wrote to memory of 2948	392	BLOCKBUSTER.exe	32
PID 392 wrote to memory of 2948	392	BLOCKBUSTER.exe	32
PID 2948 wrote to memory of 2408	2948	cmd.exe	35
PID 2948 wrote to memory of 2408	2948	cmd.exe	35
PID 2948 wrote to memory of 2408	2948	cmd.exe	35
PID 2948 wrote to memory of 2408	2948	cmd.exe	35
PID 2944 wrote to memory of 2312	2944	cmd.exe	36
PID 2944 wrote to memory of 2312	2944	cmd.exe	36
PID 2944 wrote to memory of 2312	2944	cmd.exe	36
PID 2944 wrote to memory of 2312	2944	cmd.exe	36
PID 392 wrote to memory of 3020	392	BLOCKBUSTER.exe	39
PID 392 wrote to memory of 3020	392	BLOCKBUSTER.exe	39
PID 392 wrote to memory of 3020	392	BLOCKBUSTER.exe	39
PID 392 wrote to memory of 3020	392	BLOCKBUSTER.exe	39
PID 3020 wrote to memory of 3044	3020	cmd.exe	41
PID 3020 wrote to memory of 3044	3020	cmd.exe	41
PID 3020 wrote to memory of 3044	3020	cmd.exe	41
PID 3020 wrote to memory of 3044	3020	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\BLOCKBUSTER.exe
"C:\Users\Admin\AppData\Local\Temp\BLOCKBUSTER.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /Query /TN "BLOCKBUSTER"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C SCHTASKS /Create /F /RL HIGHEST /TN "BLOCKBUSTER" /TR "C:\Users\Admin\AppData\Local\Temp\BLOCKBUSTER.exe" /SC ONLOGON /DELAY 0001:00
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /F /RL HIGHEST /TN "BLOCKBUSTER" /TR "C:\Users\Admin\AppData\Local\Temp\BLOCKBUSTER.exe" /SC ONLOGON /DELAY 0001:00
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall add rule name="BLOCKBUSTER" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\BLOCKBUSTER.exe" enable=yes profile=any
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="BLOCKBUSTER" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\BLOCKBUSTER.exe" enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\hcx.dll

Filesize
398KB

MD5
287c055b14d6ab41b021486e4fef3708

SHA1
d705e8d163d60b39e0265e30a56966c58323bef3

SHA256
3976547348f3cd6887ad0bc6a1f1f54010b58ca5cc1a77a937e882def475ab9e

SHA512
fbc627c5d06ff4440d67f7fe97ad187bf6b6472ce9f0584e7ad3d1a391e7006db97d81ac6800a80bd8304172959f01a3bc72c55773d421f2332148731a71f0b1

Download Submit
memory/392-29-0x0000000000400000-0x0000000000D36000-memory.dmp

Filesize
9.2MB

Download
memory/392-8-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/392-32-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-7-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-1-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-12-0x000000000C240000-0x000000000C241000-memory.dmp

Filesize
4KB

Download
memory/392-10-0x000000000C0C0000-0x000000000C128000-memory.dmp

Filesize
416KB

Download
memory/392-18-0x0000000000400000-0x0000000000D36000-memory.dmp

Filesize
9.2MB

Download
memory/392-34-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/392-52-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-6-0x0000000000400000-0x0000000000D36000-memory.dmp

Filesize
9.2MB

Download
memory/392-19-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-36-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-38-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-40-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-42-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-44-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-46-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-48-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-50-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download
memory/392-30-0x0000000005BE0000-0x000000000A791000-memory.dmp

Filesize
75.7MB

Download