latentbot | 6b16c2a1897f02f6f05f97ffcadd357071dc660708312b5c71341f9bb4bc285a

General

Target

6723653391970.vbs
Size

2KB
MD5

8d36763727659594c5481673a560d80c
SHA1

227412dd9a84be814117efa39544dfb173cc3b73
SHA256

6b16c2a1897f02f6f05f97ffcadd357071dc660708312b5c71341f9bb4bc285a
SHA512

69112847ed21383ce014a80af448e731b92199637b9511bcc509026cefae1dbc44a05a7849e865b72a8ca48a5e6c527d7236241b55debd7c9a27306c967f0c1e

Score

10^/10

latentbot discovery evasion persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot
Blocklisted process makes network request 2 IoCs

Processes:

WScript.exe

flow pid process

4 2964 WScript.exe
5 2964 WScript.exe
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1768 netsh.exe
Executes dropped EXE 1 IoCs

Processes:

BLOCKBUSTER.exe

pid process

2524 BLOCKBUSTER.exe
Loads dropped DLL 3 IoCs

Processes:

BLOCKBUSTER.exe

pid process

2524 BLOCKBUSTER.exe
2524 BLOCKBUSTER.exe
2524 BLOCKBUSTER.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	pid	process
4	2964	WScript.exe
5	2964	WScript.exe

pid	process
1768	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeschtasks.execmd.exenetsh.execmd.exeipconfig.exeBLOCKBUSTER.exeSCHTASKS.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BLOCKBUSTER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHTASKS.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

888 ipconfig.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2040 schtasks.exe

pid	process
888	ipconfig.exe

pid	process
2040	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

BLOCKBUSTER.exe

pid	process
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

BLOCKBUSTER.exe

pid process

2524 BLOCKBUSTER.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

BLOCKBUSTER.exe

pid process

2524 BLOCKBUSTER.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

BLOCKBUSTER.exe

pid	process
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe
2524	BLOCKBUSTER.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

WScript.exeBLOCKBUSTER.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2964 wrote to memory of 2524	2964	WScript.exe	BLOCKBUSTER.exe
PID 2964 wrote to memory of 2524	2964	WScript.exe	BLOCKBUSTER.exe
PID 2964 wrote to memory of 2524	2964	WScript.exe	BLOCKBUSTER.exe
PID 2964 wrote to memory of 2524	2964	WScript.exe	BLOCKBUSTER.exe
PID 2524 wrote to memory of 2244	2524	BLOCKBUSTER.exe	SCHTASKS.exe
PID 2524 wrote to memory of 2244	2524	BLOCKBUSTER.exe	SCHTASKS.exe
PID 2524 wrote to memory of 2244	2524	BLOCKBUSTER.exe	SCHTASKS.exe
PID 2524 wrote to memory of 2244	2524	BLOCKBUSTER.exe	SCHTASKS.exe
PID 2524 wrote to memory of 1400	2524	BLOCKBUSTER.exe	cmd.exe
PID 2524 wrote to memory of 1400	2524	BLOCKBUSTER.exe	cmd.exe
PID 2524 wrote to memory of 1400	2524	BLOCKBUSTER.exe	cmd.exe
PID 2524 wrote to memory of 1400	2524	BLOCKBUSTER.exe	cmd.exe
PID 2524 wrote to memory of 1200	2524	BLOCKBUSTER.exe	cmd.exe
PID 2524 wrote to memory of 1200	2524	BLOCKBUSTER.exe	cmd.exe
PID 2524 wrote to memory of 1200	2524	BLOCKBUSTER.exe	cmd.exe
PID 2524 wrote to memory of 1200	2524	BLOCKBUSTER.exe	cmd.exe
PID 1400 wrote to memory of 2040	1400	cmd.exe	schtasks.exe
PID 1400 wrote to memory of 2040	1400	cmd.exe	schtasks.exe
PID 1400 wrote to memory of 2040	1400	cmd.exe	schtasks.exe
PID 1400 wrote to memory of 2040	1400	cmd.exe	schtasks.exe
PID 1200 wrote to memory of 1768	1200	cmd.exe	netsh.exe
PID 1200 wrote to memory of 1768	1200	cmd.exe	netsh.exe
PID 1200 wrote to memory of 1768	1200	cmd.exe	netsh.exe
PID 1200 wrote to memory of 1768	1200	cmd.exe	netsh.exe
PID 2524 wrote to memory of 2208	2524	BLOCKBUSTER.exe	cmd.exe
PID 2524 wrote to memory of 2208	2524	BLOCKBUSTER.exe	cmd.exe
PID 2524 wrote to memory of 2208	2524	BLOCKBUSTER.exe	cmd.exe
PID 2524 wrote to memory of 2208	2524	BLOCKBUSTER.exe	cmd.exe
PID 2208 wrote to memory of 888	2208	cmd.exe	ipconfig.exe
PID 2208 wrote to memory of 888	2208	cmd.exe	ipconfig.exe
PID 2208 wrote to memory of 888	2208	cmd.exe	ipconfig.exe
PID 2208 wrote to memory of 888	2208	cmd.exe	ipconfig.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6723653391970.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2964
- C:\_672365339188b\BLOCKBUSTER.exe
  "C:\_672365339188b\BLOCKBUSTER.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\SCHTASKS.exe
    SCHTASKS /Query /TN "BLOCKBUSTER"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C SCHTASKS /Create /F /RL HIGHEST /TN "BLOCKBUSTER" /TR "C:\_672365339188b\BLOCKBUSTER.exe" /SC ONLOGON /DELAY 0001:00
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /RL HIGHEST /TN "BLOCKBUSTER" /TR "C:\_672365339188b\BLOCKBUSTER.exe" /SC ONLOGON /DELAY 0001:00
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2040
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall add rule name="BLOCKBUSTER" dir=in action=allow program="C:\_672365339188b\BLOCKBUSTER.exe" enable=yes profile=any
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\SysWOW64\netsh.exe
      netsh advfirewall firewall add rule name="BLOCKBUSTER" dir=in action=allow program="C:\_672365339188b\BLOCKBUSTER.exe" enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c ipconfig /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\_672365339188b\BLOCKBUSTER.exe

Filesize
9.1MB

MD5
74d3f521a38b23cd25ed61e4f8d99f16

SHA1
c4cd0e519aeca41e94665f2c5ea60a322deb3680

SHA256
1d822b3faabb8f65fc30076d32a95757a2c369ccb64ae54572e9f562280ae845

SHA512
ec1c8b0eb895fd8947cad6126abc5bca3a712e42475228b9dcb3496098e720abb83d4cba4621edbd8d3ad7f306a5f57ced9c2c98fe2c2d0c8ebbbf99d7faf0f1

Download Submit
C:\_67236~1\DOWNLO~1.ZIP

Filesize
38.3MB

MD5
22751b6dd47c521bc3f7a32fd7caf288

SHA1
e4bade70beab8bce6214cd151bba7e73022e76a9

SHA256
ebcdffae014a22e4294e3e82e0209486a25ef5299142f4768fa3f335f0627dce

SHA512
3a588cc4559002c7996168058659d545c26e3144eb237adbed38ac7f4fa8509c8bfa89c8db4f277abe94f89526b3d9763c0423a3995b85fb1f218111a6c3358c

Download Submit
\Users\Admin\AppData\Local\Temp\hcx.dll

Filesize
398KB

MD5
287c055b14d6ab41b021486e4fef3708

SHA1
d705e8d163d60b39e0265e30a56966c58323bef3

SHA256
3976547348f3cd6887ad0bc6a1f1f54010b58ca5cc1a77a937e882def475ab9e

SHA512
fbc627c5d06ff4440d67f7fe97ad187bf6b6472ce9f0584e7ad3d1a391e7006db97d81ac6800a80bd8304172959f01a3bc72c55773d421f2332148731a71f0b1

Download Submit
\_672365339188b\unrar.dll

Filesize
174KB

MD5
4289541be75e95bcfff04857f7144d87

SHA1
5ec8085e30d75ec18b8b1e193b3d5aa1648b0d2e

SHA256
2631fcdf920610557736549e27939b9c760743a2cddec0b2c2254cfa40003fb0

SHA512
3137a7790de74a6413aca6c80fd57288bcc30a7df3a416f3c6e8666041cd47a9609136c91405eee23224c4ae67c9aebbba4dd9c4e5786b09b83318755b4a55fd

Download Submit
memory/2524-70-0x0000000005E30000-0x000000000AB58000-memory.dmp

Filesize
77.2MB

Download
memory/2524-77-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2524-75-0x0000000000400000-0x0000000000D36000-memory.dmp

Filesize
9.2MB

Download
memory/2524-76-0x0000000005E30000-0x000000000AB58000-memory.dmp

Filesize
77.2MB

Download
memory/2524-64-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2524-81-0x000000000C560000-0x000000000C561000-memory.dmp

Filesize
4KB

Download
memory/2524-79-0x000000000C3E0000-0x000000000C448000-memory.dmp

Filesize
416KB

Download
memory/2524-87-0x0000000000400000-0x0000000000D36000-memory.dmp

Filesize
9.2MB

Download
memory/2524-88-0x0000000005E30000-0x000000000AB58000-memory.dmp

Filesize
77.2MB

Download
memory/2524-98-0x0000000000400000-0x0000000000D36000-memory.dmp

Filesize
9.2MB

Download
memory/2524-109-0x0000000005E30000-0x000000000AB58000-memory.dmp

Filesize
77.2MB

Download
memory/2524-111-0x0000000005E30000-0x000000000AB58000-memory.dmp

Filesize
77.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads