Overview

overview

10

Static

static

3

PatronusKo....1.exe

windows7-x64

10

PatronusKo....1.exe

windows10-2004-x64

10

PatronusKo...32.dll

windows7-x64

3

PatronusKo...32.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    144s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    28-11-2024 03:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    PatronusKoxp Beta v2.1/Patronus Koxp Beta v2.1.exe

  • Size

    1.9MB

  • MD5

    cae504db8e67eb5c36210d2d5abcf3fd

  • SHA1

    ff8c508712a1577a29f329a1d70878140651cd50

  • SHA256

    148424a49616617d73d96f0e8b3d28138349ea8fd3eb9312a8d62abf496aa1b9

  • SHA512

    229cb5eff1cea50104e0301e5b5217a261e69e9985829e3ee3aae821dc408f1cbe8f8cf09566d541924afab8348bac9260b4f358455e3c5768455bcf98c8dd0e

  • SSDEEP

    24576:aaeH5Z7Y4LvYQNqTwlAET6fw+DLN5jDftcXRg6puB364ROPwCGnR+ai3cMipYrG:aP0mqTRHrrPGXKuC64QoDurG

Score
10/10
latentbotdiscoverypersistencetrojan

Malware Config

Extracted

Family

latentbot

C2

yeniceriler.zapto.org

Signatures

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot
  • Latentbot family
    latentbot
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PatronusKoxp Beta v2.1\Patronus Koxp Beta v2.1.exe
    "C:\Users\Admin\AppData\Local\Temp\PatronusKoxp Beta v2.1\Patronus Koxp Beta v2.1.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\standard.exe
      C:\Users\Admin\AppData\Local\Temp\\standard.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\Users\Admin\AppData\Roaming\PATRONUS KOXP BETA V2.1.EXE
        "C:\Users\Admin\AppData\Roaming\PATRONUS KOXP BETA V2.1.EXE"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:2484
      • C:\Users\Admin\AppData\Roaming\RUNDLL.EXE
        "C:\Users\Admin\AppData\Roaming\RUNDLL.EXE"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\PatronusKoxp Beta v2.1\run.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2868
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V rundll /D "\"C:\Users\Admin\AppData\Roaming\rundll.exe \"" /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2728
            • C:\Windows\SysWOW64\reg.exe
              REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /V rundll /D "\"C:\Users\Admin\AppData\Roaming\rundll.exe \"" /f
              6⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:2736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\PatronusKoxp Beta v2.1\run.bat
    Filesize

    145B

    MD5

    6b8393408a3f2df19ff1e68a4f720729

    SHA1

    03cbc980dd47a33bdfa18be80cbd3efdbbaf95c6

    SHA256

    623fecae412449f60ffd8f38862e73504124afb0754952a45103daff0de5a7c9

    SHA512

    235e3c1f0074282c8cd8d6d9b6dc0c71ae591f5ca6a2f2248f832359a1a452cfce26b5f80fddc5acd5aae811630441b640212b9b7a885f2d69e67813d8d846ca

    Download Submit

  • C:\Users\Admin\AppData\Roaming\rundll.exe
    Filesize

    678KB

    MD5

    b4d736875783a1048e6e216d3b2b38c6

    SHA1

    1496c92d77fef5a02934bccec920c08ea97f43f7

    SHA256

    1de33c51c314957f3fc1084cbeac14ac6b1552da21b7fd91e604aca00e514b98

    SHA512

    d64d43663330caef3f8a65a37b9ab93b4a662308776faf390f3d1b59e9540572b7f262b04acd3737a90fbe542773ac94e32413058d84024c6c3e388e918a3865

    Download Submit

  • \Users\Admin\AppData\Local\Temp\standard.exe
    Filesize

    1.6MB

    MD5

    a40786ce73f802fbcce5c2c9ad18d930

    SHA1

    0e33426188644e0dcfcdd981d9d40ce8e86fb64a

    SHA256

    7d939b66f8bc2b5fde0f876fc5b664152d6c3308203fcafedd1512cb769269d2

    SHA512

    48ce814bd5940932f047ac9743ce4ab0faad3c9a8f2de60b80ff4608fa98a649470d9082e79c0982a1546c4aedbc835b59018889dee4a147d66fcd0038137690

    Download Submit

  • \Users\Admin\AppData\Roaming\ntldr.dll
    Filesize

    93KB

    MD5

    19fc09ffc7c367c396bd944ac36929e5

    SHA1

    09b4b657ca58881a649e16fc5dffe921e4f05056

    SHA256

    2d881e059893bc0bfb41d2a515f4ecca0e372df9048a00c873381eb9ae950852

    SHA512

    d15f9d8099f11611ea117b8302f27362180c4898e1bd52bc026d9a00b5a3010508b5c6fc65fb7dadf20f388c841296703acbd78abe44948ddcd643b530372577

    Download Submit

  • \Users\Admin\AppData\Roaming\patronus koxp beta v2.1.exe
    Filesize

    372KB

    MD5

    70d61abd6492d8d343de51ab9f78c08e

    SHA1

    a589c0817754a19ad750517bde22d2a8998a1aa9

    SHA256

    362adcd9adc2581c6d6701c94e5777583888a310fa3a14de525fb89363710b4d

    SHA512

    4648731184385b89bfe2f2e0cca8c71d1b29b69c00f1717a2fe47080a724ea25632da27092277f72162422b2d900dac3f7452d30bc6d3ec5a43d6783cd8f3b90

    Download Submit

  • memory/2060-10-0x0000000000400000-0x0000000000456000-memory.dmp

    Filesize

    344KB

    Download

  • memory/2320-32-0x0000000000400000-0x00000000005A5000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2320-8-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-45-0x0000000001DA0000-0x0000000001DBC000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2484-46-0x0000000004DB0000-0x0000000005E12000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/2484-59-0x0000000001DA0000-0x0000000001DBC000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2832-31-0x0000000000020000-0x000000000003C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2832-61-0x0000000000020000-0x000000000003C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2832-60-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

    Download