Analysis
-
max time kernel
140s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-12-2024 04:59
General
-
Target
ea0030759f1788428e102233a9d8f618_JaffaCakes118.exe
-
Size
957KB
-
MD5
ea0030759f1788428e102233a9d8f618
-
SHA1
26ccaa6cfc3787794ed1d8aa0ee531f6f89aff02
-
SHA256
0eca210ec47ebf2e644504653e15ddd1e34d469b58cc01af90edee23263b0ba9
-
SHA512
b78f430ab6866fbeed746f011fb1277c30ef93b57255857c0c822629a2faa143619ceb48db7c0d5bc7609514afb2ffd3bba5446d951a033c25a64bb7679bacaa
-
SSDEEP
24576:QBN9TWxzGXdXtMPhZIy8FW5QyoxcbBNlyy:QtT+zOpOPhT6ybX
Score
10/10
Malware Config
Extracted
Family
latentbot
C2
dminformatica.zapto.org
Signatures
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Latentbot family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea0030759f1788428e102233a9d8f618_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea0030759f1788428e102233a9d8f618_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2ec 0x49c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB