latentbot | 86b7a285f8bea6cb34c84d34cb40c6e180acdaacb494dbf9f9786d739fb9d697

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/03/2025, 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wkey.exe
Size

717KB
MD5

16013a9f7550c064bd3dbb2390c86391
SHA1

1aa320abd0fb0f7da44350c9ad26e1cb1b910ce3
SHA256

c0d0064a072b9a239934cd21876cb90122d256a107550b137c7ca5a397f86f6f
SHA512

976b262e8460d3b25f4cf4e94e2643ffdeab937f29c05773c94f390964c63da094770b8f786870a119b10155861e5fe359292b80276e81e6ed621d7022ceefe3
SSDEEP

12288:TANwRo+mv8QD4+0V16RKxafznaHSTk+OqCrJ4lkTpoKw7e9f44sF8VN0PsxQ4TNa:TAT8QE+krCnayTk7frelkWK/9g4isxQv

Score

10^/10

latentbot defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

latentbot

themrbadboy.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2184	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\12ce4e06a81e8d54fd01d9b762f1b1bb.exe	system.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\12ce4e06a81e8d54fd01d9b762f1b1bb.exe	system.exe

Executes dropped EXE 5 IoCs

pid	Process
2472	sys.exe
2408	WKey_demo.exe
2216	WKey_demo.tmp
2812	system.exe
1040	WKey.exe

Loads dropped DLL 9 IoCs

pid	Process
3052	Wkey.exe
2408	WKey_demo.exe
2216	WKey_demo.tmp
2216	WKey_demo.tmp
2472	sys.exe
2216	WKey_demo.tmp
2216	WKey_demo.tmp
2216	WKey_demo.tmp
2216	WKey_demo.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\12ce4e06a81e8d54fd01d9b762f1b1bb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe\" .."	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\12ce4e06a81e8d54fd01d9b762f1b1bb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe\" .."	system.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sys.exe	Wkey.exe
File opened for modification	C:\Windows\SysWOW64\sys.exe	Wkey.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Alpine Snow\Wireless Key\Uninstall.exe	Wkey.exe
File created	C:\Program Files (x86)\Alpine Snow\Wireless Key\Uninstall.ini	Wkey.exe
File created	C:\Program Files (x86)\Wireless WEP Key Password Spy\is-8JES4.tmp	WKey_demo.tmp
File created	C:\Program Files (x86)\Wireless WEP Key Password Spy\is-BRJ1J.tmp	WKey_demo.tmp
File created	C:\Program Files (x86)\Wireless WEP Key Password Spy\is-E2EP4.tmp	WKey_demo.tmp
File created	C:\Program Files (x86)\Alpine Snow\Wireless Key\Uninstall.exe	Wkey.exe
File created	C:\Program Files (x86)\Wireless WEP Key Password Spy\unins000.dat	WKey_demo.tmp
File created	C:\Program Files (x86)\Wireless WEP Key Password Spy\is-Q03S2.tmp	WKey_demo.tmp
File created	C:\Program Files (x86)\Wireless WEP Key Password Spy\is-5I9CV.tmp	WKey_demo.tmp
File opened for modification	C:\Program Files (x86)\Wireless WEP Key Password Spy\unins000.dat	WKey_demo.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\WKey_demo.exe	Wkey.exe
File opened for modification	C:\Windows\WKey_demo.exe	Wkey.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WKey_demo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WKey_demo.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WKey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wkey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sys.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2812	system.exe
2812	system.exe
2812	system.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	system.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	WKey_demo.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1040	WKey.exe
1040	WKey.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2472	3052	Wkey.exe	30
PID 3052 wrote to memory of 2472	3052	Wkey.exe	30
PID 3052 wrote to memory of 2472	3052	Wkey.exe	30
PID 3052 wrote to memory of 2472	3052	Wkey.exe	30
PID 3052 wrote to memory of 2408	3052	Wkey.exe	31
PID 3052 wrote to memory of 2408	3052	Wkey.exe	31
PID 3052 wrote to memory of 2408	3052	Wkey.exe	31
PID 3052 wrote to memory of 2408	3052	Wkey.exe	31
PID 3052 wrote to memory of 2408	3052	Wkey.exe	31
PID 3052 wrote to memory of 2408	3052	Wkey.exe	31
PID 3052 wrote to memory of 2408	3052	Wkey.exe	31
PID 2408 wrote to memory of 2216	2408	WKey_demo.exe	32
PID 2408 wrote to memory of 2216	2408	WKey_demo.exe	32
PID 2408 wrote to memory of 2216	2408	WKey_demo.exe	32
PID 2408 wrote to memory of 2216	2408	WKey_demo.exe	32
PID 2408 wrote to memory of 2216	2408	WKey_demo.exe	32
PID 2408 wrote to memory of 2216	2408	WKey_demo.exe	32
PID 2408 wrote to memory of 2216	2408	WKey_demo.exe	32
PID 2472 wrote to memory of 2812	2472	sys.exe	33
PID 2472 wrote to memory of 2812	2472	sys.exe	33
PID 2472 wrote to memory of 2812	2472	sys.exe	33
PID 2472 wrote to memory of 2812	2472	sys.exe	33
PID 2812 wrote to memory of 2184	2812	system.exe	34
PID 2812 wrote to memory of 2184	2812	system.exe	34
PID 2812 wrote to memory of 2184	2812	system.exe	34
PID 2812 wrote to memory of 2184	2812	system.exe	34
PID 2216 wrote to memory of 1040	2216	WKey_demo.tmp	38
PID 2216 wrote to memory of 1040	2216	WKey_demo.tmp	38
PID 2216 wrote to memory of 1040	2216	WKey_demo.tmp	38
PID 2216 wrote to memory of 1040	2216	WKey_demo.tmp	38

C:\Users\Admin\AppData\Local\Temp\Wkey.exe
"C:\Users\Admin\AppData\Local\Temp\Wkey.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\sys.exe
  "C:\Windows\system32\sys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Users\Admin\AppData\Local\Temp\system.exe
    "C:\Users\Admin\AppData\Local\Temp\system.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\system.exe" "system.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2184
- C:\Windows\WKey_demo.exe
  "C:\Windows\WKey_demo.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Users\Admin\AppData\Local\Temp\is-CJ1J9.tmp\WKey_demo.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-CJ1J9.tmp\WKey_demo.tmp" /SL5="$501D6,113279,54272,C:\Windows\WKey_demo.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Program Files (x86)\Wireless WEP Key Password Spy\WKey.exe
      "C:\Program Files (x86)\Wireless WEP Key Password Spy\WKey.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\WKey_demo.exe

Filesize
364KB

MD5
3f4ed090be1461756b669f86cc591766

SHA1
666dbd68f56bb9f011a765378a4f3c152977c951

SHA256
15adf709e37e1342a24a1a59e0fe09452f7399755e54087b579b230b8d86f37a

SHA512
cb4b4d39088b7cafcd27d2403c6c130c439bcd4cf8dbd998bbd0847ecf1358b91aed743554273cbeae2dc29d3c0dff13e43c07a82d893fb7cb683d3ff684a56b

Download Submit
\Program Files (x86)\Wireless WEP Key Password Spy\WKey.exe

Filesize
120KB

MD5
80d2df0444140e5dd15dba41ff09c734

SHA1
c83d30248f2c2acfa0507b1c6e1dfb4a37b149fb

SHA256
413f3fe2c4d3eecb7e3e9c7ec3b5b96d001e1debe41a643717abfee8fb0cd5da

SHA512
8c2f95c06d76a08cd45c537ef855237957a399f32bccdb1d60ca1f492be95b4aa6d64e8f95ed9dd335d8c4f1ce51e398a3b0eadf51fd5c5820e4ec65d9e7c0a3

Download Submit
\Program Files (x86)\Wireless WEP Key Password Spy\unins000.exe

Filesize
697KB

MD5
bbbf6577b5eb9c6fba76d11b109a6900

SHA1
340452868dd093737d74e81b63baf7fc42f1bd20

SHA256
e9b00c0aebcee913dfb7ebc52e681c22543a2e0a7d9741c868a3dc0f182b7037

SHA512
386169b5bee0d4c83e398a7caef14126b2daa3046c4552aa6d87e713900fd3e60164b9aba788e89aa1be5450a767c7bc9624fe85b3709f26d0eea71aa59f7c7b

Download Submit
\Users\Admin\AppData\Local\Temp\is-AVHQS.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-CJ1J9.tmp\WKey_demo.tmp

Filesize
687KB

MD5
c080f73b1bdde0853cb0258d9a02b0ec

SHA1
a5112a53e6e75069ac06b7bbd658f7cf2c8f2dee

SHA256
a0cfbc8da39ad4a4d21c61d73873d225ffa5d7650fae5938ab643f719d5f7363

SHA512
e514be3f983de22c0f67bac318686b7fe75cb6fd9832f3603077ad25c559155b7df71555b92bb6366835a104c8d2828cec2766fb7f855bd3f79f66319d6a5eac

Download Submit
\Windows\SysWOW64\sys.exe

Filesize
51KB

MD5
14ea1ab95fe959e4c3ebab591040f438

SHA1
5f86acfaf6fa85344c771069f3efcc9b14bc8357

SHA256
043386e7b5d59cb0834ce4a6ef28c160186a1535198cc1cc761f53bf96c29da9

SHA512
cafb15d9257b776eea2f81c490515781468c57e26de7ad5f0c3861c37897b607f212e1702b39ae5eaec6a3ecd5913ecd8acd6dffcbc29621b090dc135429c83b

Download Submit
memory/2216-51-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2216-90-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2408-23-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2408-39-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2408-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2408-91-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2472-48-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/2472-40-0x0000000074332000-0x0000000074334000-memory.dmp

Filesize
8KB

Download
memory/2472-38-0x0000000074330000-0x00000000748DB000-memory.dmp

Filesize
5.7MB

Download
memory/2472-19-0x0000000074331000-0x0000000074332000-memory.dmp

Filesize
4KB

Download
memory/3052-22-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download