Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
27/01/2025, 19:41
General
- Target JaffaCakes118_430d719abd61377b5df44f32f5013e66.exe
- Size 56KB
- Sample250127-yefvmatmbn
- SHA256 d268d3ba289a8914a475378290f4aefcaf9722032fc878cfe48ea636c94f9d9b
Score
10/10
Malware Config
Extracted
Family
-
latentbot
C2
-
dasubertang3.zapto.org
Signatures
- LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
- Latentbot family
- Adds Run key to start application 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_430d719abd61377b5df44f32f5013e66.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_430d719abd61377b5df44f32f5013e66.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3352-0-0x00000000754D2000-0x00000000754D3000-memory.dmp
memory/3352-1-0x00000000754D0000-0x0000000075A81000-memory.dmp
memory/3352-2-0x00000000754D0000-0x0000000075A81000-memory.dmp
memory/3352-4-0x00000000754D2000-0x00000000754D3000-memory.dmp
memory/3352-5-0x00000000754D0000-0x0000000075A81000-memory.dmp
memory/3352-6-0x00000000754D0000-0x0000000075A81000-memory.dmp
memory/3352-7-0x00000000754D0000-0x0000000075A81000-memory.dmp