latentbot | 3a4f8430dd794e93e9f2ac368c9b6f61c93609e0e52afe292a1aa95abae99453

General

Target

JaffaCakes118_7988827f545203ac2ea13c652d5674a8.exe
Size

731KB
MD5

7988827f545203ac2ea13c652d5674a8
SHA1

27c7674a9783458a03df947db92af9f0bda59cda
SHA256

3a4f8430dd794e93e9f2ac368c9b6f61c93609e0e52afe292a1aa95abae99453
SHA512

e4875f25e566ba353381838e8fc19aec100f459691353e50f78a1e5cf0bf4324f0603cb26dc6ee634438e230b62930ea0e2935f1ed5568999d2c0e3571686e89
SSDEEP

12288:4rOq7yb4relPEb8UbxI0k9V7dTxfPzscAO3t8MYPbEum9X2cqwW8hlZaM:4rOMyE8PEbK0uVHkeubEum9XXqJsbaM

Score

10^/10

latentbot defense_evasion discovery persistence privilege_escalation trojan upx

Malware Config

Extracted

Family

latentbot

C2

hakerbolbol.zapto.org

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2424	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\717b83676f0ab8c5935f4e7857307217.exe	gorft.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\717b83676f0ab8c5935f4e7857307217.exe	gorft.exe

Executes dropped EXE 3 IoCs

pid	Process
2944	fsdgtrds.Rummage.exe
2388	file_recovery_2.exe
2604	gorft.exe

Loads dropped DLL 1 IoCs

pid	Process
2944	fsdgtrds.Rummage.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\717b83676f0ab8c5935f4e7857307217 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\gorft.exe\" .."	gorft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\717b83676f0ab8c5935f4e7857307217 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\gorft.exe\" .."	gorft.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	file_recovery_2.exe
File opened (read-only)	\??\l:	file_recovery_2.exe
File opened (read-only)	\??\v:	file_recovery_2.exe
File opened (read-only)	\??\w:	file_recovery_2.exe
File opened (read-only)	\??\x:	file_recovery_2.exe
File opened (read-only)	\??\y:	file_recovery_2.exe
File opened (read-only)	\??\z:	file_recovery_2.exe
File opened (read-only)	\??\b:	file_recovery_2.exe
File opened (read-only)	\??\g:	file_recovery_2.exe
File opened (read-only)	\??\k:	file_recovery_2.exe
File opened (read-only)	\??\m:	file_recovery_2.exe
File opened (read-only)	\??\o:	file_recovery_2.exe
File opened (read-only)	\??\h:	file_recovery_2.exe
File opened (read-only)	\??\p:	file_recovery_2.exe
File opened (read-only)	\??\q:	file_recovery_2.exe
File opened (read-only)	\??\e:	file_recovery_2.exe
File opened (read-only)	\??\j:	file_recovery_2.exe
File opened (read-only)	\??\n:	file_recovery_2.exe
File opened (read-only)	\??\r:	file_recovery_2.exe
File opened (read-only)	\??\s:	file_recovery_2.exe
File opened (read-only)	\??\t:	file_recovery_2.exe
File opened (read-only)	\??\u:	file_recovery_2.exe
File opened (read-only)	\??\a:	file_recovery_2.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2388-15-0x0000000000400000-0x00000000005C5000-memory.dmp	upx
behavioral1/files/0x0008000000016d17-12.dat	upx
behavioral1/memory/2388-28-0x0000000000400000-0x00000000005C5000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file_recovery_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsdgtrds.Rummage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gorft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2604	gorft.exe
2604	gorft.exe
2604	gorft.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	file_recovery_2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	JaffaCakes118_7988827f545203ac2ea13c652d5674a8.exe
Token: SeDebugPrivilege	2604	gorft.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2944	2856	JaffaCakes118_7988827f545203ac2ea13c652d5674a8.exe	31
PID 2856 wrote to memory of 2944	2856	JaffaCakes118_7988827f545203ac2ea13c652d5674a8.exe	31
PID 2856 wrote to memory of 2944	2856	JaffaCakes118_7988827f545203ac2ea13c652d5674a8.exe	31
PID 2856 wrote to memory of 2944	2856	JaffaCakes118_7988827f545203ac2ea13c652d5674a8.exe	31
PID 2856 wrote to memory of 2388	2856	JaffaCakes118_7988827f545203ac2ea13c652d5674a8.exe	32
PID 2856 wrote to memory of 2388	2856	JaffaCakes118_7988827f545203ac2ea13c652d5674a8.exe	32
PID 2856 wrote to memory of 2388	2856	JaffaCakes118_7988827f545203ac2ea13c652d5674a8.exe	32
PID 2856 wrote to memory of 2388	2856	JaffaCakes118_7988827f545203ac2ea13c652d5674a8.exe	32
PID 2944 wrote to memory of 2604	2944	fsdgtrds.Rummage.exe	33
PID 2944 wrote to memory of 2604	2944	fsdgtrds.Rummage.exe	33
PID 2944 wrote to memory of 2604	2944	fsdgtrds.Rummage.exe	33
PID 2944 wrote to memory of 2604	2944	fsdgtrds.Rummage.exe	33
PID 2604 wrote to memory of 2424	2604	gorft.exe	34
PID 2604 wrote to memory of 2424	2604	gorft.exe	34
PID 2604 wrote to memory of 2424	2604	gorft.exe	34
PID 2604 wrote to memory of 2424	2604	gorft.exe	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7988827f545203ac2ea13c652d5674a8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7988827f545203ac2ea13c652d5674a8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\fsdgtrds.Rummage.exe
  "C:\Users\Admin\AppData\Local\Temp\fsdgtrds.Rummage.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\gorft.exe
    "C:\Users\Admin\AppData\Local\Temp\gorft.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\gorft.exe" "gorft.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2424
- C:\Users\Admin\AppData\Local\Temp\file_recovery_2.exe
  "C:\Users\Admin\AppData\Local\Temp\file_recovery_2.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e653d73e45833b6c

Filesize
8B

MD5
f6bf7388adffaca991fc24ca2148bce3

SHA1
950c1d389e746d51b7acffa662d3f713a293979e

SHA256
2b63e36f1098c8eb8f5c5f4d67b792586bdda9499dee8c987f9784a582cd28bd

SHA512
0e31d51c050c5acec3a908e58c58180e632ae059ae3a5f8d20e6e2abaf54c1427af338e81f662239bce52a6acef071e906f83e3025f6236ff5db9056107c5aa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\file_recovery_2.exe

Filesize
482KB

MD5
276d5b7ca6303c28492807f4d1d92309

SHA1
68f2bf37c6952a5a5e2ee06c721a40ecac244439

SHA256
a8b210be8d7774a898df8306a4f2110d99218198fb842fdcd180c624c765f8aa

SHA512
e0388aa6700e9d1cceef3d755083f3234b2c5e542fc0a64df528d3e5e3bdebf6d45aa215bc49640677748bf04b72083096292161b6fe87b7db040d2e56292423

Download Submit
C:\Users\Admin\AppData\Local\Temp\fsdgtrds.Rummage.exe

Filesize
52KB

MD5
96681f9a5f34f4c09405674b1e22a35e

SHA1
700ce6e277c8dfd78ac98319fecf986691297dd6

SHA256
7c5f8d2446616124bfee0b2f217194acdb3088ab0b6d31cc01a1c84fa988ec1c

SHA512
c73b4a0300dce59d22ab89d3f4e7d6b87a120ca3f3480831f309d4f01675a425b705ec362037f5aefa6dc76e6aae5060354843e2952ad5cac6877e7d803a4563

Download Submit
memory/2388-15-0x0000000000400000-0x00000000005C5000-memory.dmp

Filesize
1.8MB

Download
memory/2388-16-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2388-28-0x0000000000400000-0x00000000005C5000-memory.dmp

Filesize
1.8MB

Download
memory/2388-29-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2856-0-0x000007FEF5B2E000-0x000007FEF5B2F000-memory.dmp

Filesize
4KB

Download
memory/2856-1-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2856-3-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2856-14-0x000007FEF5870000-0x000007FEF620D000-memory.dmp

Filesize
9.6MB

Download
memory/2944-17-0x0000000000360000-0x00000000003A0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads