latentbot | 6c4f362c28bb72facbd384afffb2fafa91a0b9dae5b6f2fd8a51490e6598b756

Analysis

max time kernel
148s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Size

1.1MB
MD5

fbf9993af55fd6b91076fe0280b9cf88
SHA1

6215ab3eb496420ee1129c67177c376a98e62ea9
SHA256

6c4f362c28bb72facbd384afffb2fafa91a0b9dae5b6f2fd8a51490e6598b756
SHA512

9346e09cb01e4d1e5d7049b3a4f19c4e23828c26e599605087ebe1364124140c67e79ce1757dbb67dcd60cb1b77325967f16806253a8c6e495ff32e80fa8ca84
SSDEEP

24576:uK/cRgOnmq9g61r43VHpmhg5yfenrkTf8/hytOXH2nek3zweOHc6KFvlvRdHwKV0:FcOU7m6aHpmiymQeSe2nTjweOHcl5QH

Score

10^/10

latentbot discovery trojan

Malware Config

Extracted

Family

latentbot

metin2destek.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2624	PUMA BOT.EXE

Loads dropped DLL 2 IoCs

pid	Process
2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PUMA BOT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeSecurityPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeBackupPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeRestorePrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeShutdownPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeDebugPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeUndockPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: 33	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: 34	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
Token: 35	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
2624	PUMA BOT.EXE
2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2204	2860	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	30
PID 2204 wrote to memory of 2624	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	31
PID 2204 wrote to memory of 2624	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	31
PID 2204 wrote to memory of 2624	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	31
PID 2204 wrote to memory of 2624	2204	fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Users\Admin\AppData\Local\Temp\fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fbf9993af55fd6b91076fe0280b9cf88_JaffaCakes118.exe"
  2⤵
  - Checks BIOS information in registry
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\PUMA BOT.EXE
    "C:\Users\Admin\AppData\Local\Temp\PUMA BOT.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PUMA BOT.EXE

Filesize
112KB

MD5
396752b01a46655db72d27f80664bd52

SHA1
ee62b2fc193a93aad7c419e33624dfd0d3721ea7

SHA256
29416ea859c74c4dd3e9e594aaa342897f790d4523d075548ecdb1766409caab

SHA512
409abab98a3a7c6bb1a5deddba397e4505685c98cf34125e7e3cd66c0a5576c8e2b6f60c1920c2bd4f8ca6477eff7d7173f4cfb984022253f19b773c54df878d

Download Submit
memory/2204-72-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-74-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-85-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-83-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-82-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-81-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-80-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-79-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-78-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-77-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-76-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-75-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-73-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-69-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2204-34-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-70-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-37-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-32-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-29-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-28-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-38-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-25-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-84-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-36-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-24-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-21-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-19-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2204-71-0x0000000000400000-0x00000000004DC000-memory.dmp

Filesize
880KB

Download
memory/2860-41-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2860-14-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2860-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/2860-1-0x0000000000290000-0x00000000002F0000-memory.dmp

Filesize
384KB

Download
memory/2860-18-0x0000000003D70000-0x0000000003DDD000-memory.dmp

Filesize
436KB

Download
memory/2860-3-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2860-15-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2860-6-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2860-5-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2860-4-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2860-11-0x00000000035B0000-0x00000000035B1000-memory.dmp

Filesize
4KB

Download
memory/2860-7-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2860-8-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2860-9-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2860-10-0x0000000003560000-0x0000000003562000-memory.dmp

Filesize
8KB

Download
memory/2860-40-0x0000000000290000-0x00000000002F0000-memory.dmp

Filesize
384KB

Download
memory/2860-13-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads