latentbot | ae6f59d14ce7584e9dccf8e88f540fac601d92d35c6e6b0013f4e6682d08e7e5

General

Target

ORDER DRAWING AND PHOTOS.exe
Size

2.0MB
MD5

395bb950d2979e4c3911d90852c06345
SHA1

2a693150907af200bbf8582a69e663d23249c7d0
SHA256

1adbc19898a40ae7f2c6fd9a6d1c502c7152ba6b04d4584e2c7476606f9b24ff
SHA512

d95b46177b0820f286e99f647ff398788d24502885fc2b63fe19dfb1a58d7ae15cabd2749ab00b709b37a3fb75b9ccf28628ad2f686a507fc1142486a8f32b61
SSDEEP

12288:xkNH+OOlsur4fwML7K6yD210eS+Fl1DkjGKUuU6Sn:mH+D+Hb3K6yD22eTl1oj1UYq

Score

10^/10

latentbot stormkitty xworm discovery rat stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

C2

weidmachane.zapto.org:7000

Mutex

Y3sPpIW4xQztdVfl

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

latentbot

C2

weidmachane.zapto.org

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/800-4-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/800-14-0x0000000006AD0000-0x0000000006BF0000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4136 set thread context of 800	4136	ORDER DRAWING AND PHOTOS.exe	88

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
632	800	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	800	AddInProcess32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 348	4136	ORDER DRAWING AND PHOTOS.exe	87
PID 4136 wrote to memory of 348	4136	ORDER DRAWING AND PHOTOS.exe	87
PID 4136 wrote to memory of 348	4136	ORDER DRAWING AND PHOTOS.exe	87
PID 4136 wrote to memory of 800	4136	ORDER DRAWING AND PHOTOS.exe	88
PID 4136 wrote to memory of 800	4136	ORDER DRAWING AND PHOTOS.exe	88
PID 4136 wrote to memory of 800	4136	ORDER DRAWING AND PHOTOS.exe	88
PID 4136 wrote to memory of 800	4136	ORDER DRAWING AND PHOTOS.exe	88
PID 4136 wrote to memory of 800	4136	ORDER DRAWING AND PHOTOS.exe	88
PID 4136 wrote to memory of 800	4136	ORDER DRAWING AND PHOTOS.exe	88
PID 4136 wrote to memory of 800	4136	ORDER DRAWING AND PHOTOS.exe	88
PID 4136 wrote to memory of 800	4136	ORDER DRAWING AND PHOTOS.exe	88
PID 4136 wrote to memory of 3664	4136	ORDER DRAWING AND PHOTOS.exe	89
PID 4136 wrote to memory of 3664	4136	ORDER DRAWING AND PHOTOS.exe	89
PID 4136 wrote to memory of 3664	4136	ORDER DRAWING AND PHOTOS.exe	89

C:\Users\Admin\AppData\Local\Temp\ORDER DRAWING AND PHOTOS.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER DRAWING AND PHOTOS.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 1568
    3⤵
    - Program crash
    PID:632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 800 -ip 800
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-8-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/800-13-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/800-9-0x000000007523E000-0x000000007523F000-memory.dmp

Filesize
4KB

Download
memory/800-10-0x0000000006050000-0x00000000060B6000-memory.dmp

Filesize
408KB

Download
memory/800-4-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/800-5-0x000000007523E000-0x000000007523F000-memory.dmp

Filesize
4KB

Download
memory/800-16-0x00000000070D0000-0x000000000711C000-memory.dmp

Filesize
304KB

Download
memory/800-7-0x0000000005900000-0x000000000599C000-memory.dmp

Filesize
624KB

Download
memory/800-55-0x0000000075230000-0x00000000759E0000-memory.dmp

Filesize
7.7MB

Download
memory/800-15-0x0000000006D30000-0x0000000007084000-memory.dmp

Filesize
3.3MB

Download
memory/800-14-0x0000000006AD0000-0x0000000006BF0000-memory.dmp

Filesize
1.1MB

Download
memory/800-11-0x0000000006C90000-0x0000000006D22000-memory.dmp

Filesize
584KB

Download
memory/800-12-0x00000000072E0000-0x0000000007884000-memory.dmp

Filesize
5.6MB

Download
memory/4136-1-0x000002AF7DE70000-0x000002AF7DE76000-memory.dmp

Filesize
24KB

Download
memory/4136-3-0x00007FFB27EC0000-0x00007FFB28981000-memory.dmp

Filesize
10.8MB

Download
memory/4136-2-0x000002AF18390000-0x000002AF183F2000-memory.dmp

Filesize
392KB

Download
memory/4136-6-0x00007FFB27EC0000-0x00007FFB28981000-memory.dmp

Filesize
10.8MB

Download
memory/4136-0-0x00007FFB27EC3000-0x00007FFB27EC5000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads