latentbot | 86b7a285f8bea6cb34c84d34cb40c6e180acdaacb494dbf9f9786d739fb9d697

General

Target

Wkey.exe
Size

717KB
MD5

16013a9f7550c064bd3dbb2390c86391
SHA1

1aa320abd0fb0f7da44350c9ad26e1cb1b910ce3
SHA256

c0d0064a072b9a239934cd21876cb90122d256a107550b137c7ca5a397f86f6f
SHA512

976b262e8460d3b25f4cf4e94e2643ffdeab937f29c05773c94f390964c63da094770b8f786870a119b10155861e5fe359292b80276e81e6ed621d7022ceefe3
SSDEEP

12288:TANwRo+mv8QD4+0V16RKxafznaHSTk+OqCrJ4lkTpoKw7e9f44sF8VN0PsxQ4TNa:TAT8QE+krCnayTk7frelkWK/9g4isxQv

Score

10^/10

latentbot defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

latentbot

C2

themrbadboy.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3068	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	Wkey.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\Control Panel\International\Geo\Nation	sys.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\12ce4e06a81e8d54fd01d9b762f1b1bb.exe	system.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\12ce4e06a81e8d54fd01d9b762f1b1bb.exe	system.exe

Executes dropped EXE 5 IoCs

pid	Process
2628	sys.exe
6104	WKey_demo.exe
6096	WKey_demo.tmp
3232	system.exe
4540	WKey.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1294999112-580688058-1763548717-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\12ce4e06a81e8d54fd01d9b762f1b1bb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe\" .."	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\12ce4e06a81e8d54fd01d9b762f1b1bb = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\system.exe\" .."	system.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sys.exe	Wkey.exe
File opened for modification	C:\Windows\SysWOW64\sys.exe	Wkey.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Alpine Snow\Wireless Key\Uninstall.exe	Wkey.exe
File created	C:\Program Files (x86)\Alpine Snow\Wireless Key\Uninstall.ini	Wkey.exe
File created	C:\Program Files (x86)\Wireless WEP Key Password Spy\unins000.dat	WKey_demo.tmp
File created	C:\Program Files (x86)\Wireless WEP Key Password Spy\is-OU1KR.tmp	WKey_demo.tmp
File created	C:\Program Files (x86)\Wireless WEP Key Password Spy\is-QKNL7.tmp	WKey_demo.tmp
File created	C:\Program Files (x86)\Wireless WEP Key Password Spy\is-O5D6N.tmp	WKey_demo.tmp
File created	C:\Program Files (x86)\Wireless WEP Key Password Spy\is-O4GPI.tmp	WKey_demo.tmp
File opened for modification	C:\Program Files (x86)\Wireless WEP Key Password Spy\unins000.dat	WKey_demo.tmp
File created	C:\Program Files (x86)\Alpine Snow\Wireless Key\Uninstall.exe	Wkey.exe
File created	C:\Program Files (x86)\Wireless WEP Key Password Spy\is-L7RLB.tmp	WKey_demo.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\WKey_demo.exe	Wkey.exe
File opened for modification	C:\Windows\WKey_demo.exe	Wkey.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WKey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wkey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WKey_demo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WKey_demo.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe
3232	system.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3232	system.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6096	WKey_demo.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4540	WKey.exe
4540	WKey.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 2628	3104	Wkey.exe	88
PID 3104 wrote to memory of 2628	3104	Wkey.exe	88
PID 3104 wrote to memory of 2628	3104	Wkey.exe	88
PID 3104 wrote to memory of 6104	3104	Wkey.exe	89
PID 3104 wrote to memory of 6104	3104	Wkey.exe	89
PID 3104 wrote to memory of 6104	3104	Wkey.exe	89
PID 6104 wrote to memory of 6096	6104	WKey_demo.exe	90
PID 6104 wrote to memory of 6096	6104	WKey_demo.exe	90
PID 6104 wrote to memory of 6096	6104	WKey_demo.exe	90
PID 2628 wrote to memory of 3232	2628	sys.exe	92
PID 2628 wrote to memory of 3232	2628	sys.exe	92
PID 2628 wrote to memory of 3232	2628	sys.exe	92
PID 3232 wrote to memory of 3068	3232	system.exe	93
PID 3232 wrote to memory of 3068	3232	system.exe	93
PID 3232 wrote to memory of 3068	3232	system.exe	93
PID 6096 wrote to memory of 4540	6096	WKey_demo.tmp	105
PID 6096 wrote to memory of 4540	6096	WKey_demo.tmp	105
PID 6096 wrote to memory of 4540	6096	WKey_demo.tmp	105

C:\Users\Admin\AppData\Local\Temp\Wkey.exe
"C:\Users\Admin\AppData\Local\Temp\Wkey.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\SysWOW64\sys.exe
  "C:\Windows\system32\sys.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Users\Admin\AppData\Local\Temp\system.exe
    "C:\Users\Admin\AppData\Local\Temp\system.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\system.exe" "system.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3068
- C:\Windows\WKey_demo.exe
  "C:\Windows\WKey_demo.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Users\Admin\AppData\Local\Temp\is-NQME4.tmp\WKey_demo.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-NQME4.tmp\WKey_demo.tmp" /SL5="$90054,113279,54272,C:\Windows\WKey_demo.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6096
  - - C:\Program Files (x86)\Wireless WEP Key Password Spy\WKey.exe
      "C:\Program Files (x86)\Wireless WEP Key Password Spy\WKey.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Wireless WEP Key Password Spy\WKey.exe

Filesize
120KB

MD5
80d2df0444140e5dd15dba41ff09c734

SHA1
c83d30248f2c2acfa0507b1c6e1dfb4a37b149fb

SHA256
413f3fe2c4d3eecb7e3e9c7ec3b5b96d001e1debe41a643717abfee8fb0cd5da

SHA512
8c2f95c06d76a08cd45c537ef855237957a399f32bccdb1d60ca1f492be95b4aa6d64e8f95ed9dd335d8c4f1ce51e398a3b0eadf51fd5c5820e4ec65d9e7c0a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NQME4.tmp\WKey_demo.tmp

Filesize
687KB

MD5
c080f73b1bdde0853cb0258d9a02b0ec

SHA1
a5112a53e6e75069ac06b7bbd658f7cf2c8f2dee

SHA256
a0cfbc8da39ad4a4d21c61d73873d225ffa5d7650fae5938ab643f719d5f7363

SHA512
e514be3f983de22c0f67bac318686b7fe75cb6fd9832f3603077ad25c559155b7df71555b92bb6366835a104c8d2828cec2766fb7f855bd3f79f66319d6a5eac

Download Submit
C:\Windows\SysWOW64\sys.exe

Filesize
51KB

MD5
14ea1ab95fe959e4c3ebab591040f438

SHA1
5f86acfaf6fa85344c771069f3efcc9b14bc8357

SHA256
043386e7b5d59cb0834ce4a6ef28c160186a1535198cc1cc761f53bf96c29da9

SHA512
cafb15d9257b776eea2f81c490515781468c57e26de7ad5f0c3861c37897b607f212e1702b39ae5eaec6a3ecd5913ecd8acd6dffcbc29621b090dc135429c83b

Download Submit
C:\Windows\WKey_demo.exe

Filesize
364KB

MD5
3f4ed090be1461756b669f86cc591766

SHA1
666dbd68f56bb9f011a765378a4f3c152977c951

SHA256
15adf709e37e1342a24a1a59e0fe09452f7399755e54087b579b230b8d86f37a

SHA512
cb4b4d39088b7cafcd27d2403c6c130c439bcd4cf8dbd998bbd0847ecf1358b91aed743554273cbeae2dc29d3c0dff13e43c07a82d893fb7cb683d3ff684a56b

Download Submit
memory/2628-54-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/2628-33-0x0000000074A02000-0x0000000074A03000-memory.dmp

Filesize
4KB

Download
memory/2628-37-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/2628-38-0x0000000074A00000-0x0000000074FB1000-memory.dmp

Filesize
5.7MB

Download
memory/3104-27-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/6096-57-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/6096-42-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/6096-58-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/6096-89-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/6104-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6104-29-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6104-32-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/6104-90-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads