Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
06/04/2025, 16:00
General
-
Target
JaffaCakes118_9bd2f65fd306a7c63123a81a39a572c7.exe
-
Size
162KB
-
MD5
9bd2f65fd306a7c63123a81a39a572c7
-
SHA1
8dd51d4f8a7c556d25a18bf2c3fa726b320783e8
-
SHA256
316f49af70c95350bb0df489ea7ed29e56f5cb57dcc7419d379208e7eae043b3
-
SHA512
8cd81f211bd857329e798c21dacce29ab9582a315bb395e61f18823dd52b523d3f17c3b263f813588c432e23424ec306bb268527dc7a09a8423f721b377ed9f8
-
SSDEEP
3072:Pf06mWDb4C5cWPhIbPNjtzZ/VsUu4W/0blXohs+JX+q:0cbZrpIbPNjtz/VW/0blXC
Malware Config
Extracted
latentbot
cybergateperez.zapto.org
Signatures
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Latentbot family
-
Drops startup file 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9bd2f65fd306a7c63123a81a39a572c7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9bd2f65fd306a7c63123a81a39a572c7.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\System32\JaffaCakes118_9bd2f65fd306a7c63123a81a39a572c7.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\System32\JaffaCakes118_9bd2f65fd306a7c63123a81a39a572c7.exeC:\Users\Admin\Documents\System32\JaffaCakes118_9bd2f65fd306a7c63123a81a39a572c7.exe2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD59bd2f65fd306a7c63123a81a39a572c7
SHA18dd51d4f8a7c556d25a18bf2c3fa726b320783e8
SHA256316f49af70c95350bb0df489ea7ed29e56f5cb57dcc7419d379208e7eae043b3
SHA5128cd81f211bd857329e798c21dacce29ab9582a315bb395e61f18823dd52b523d3f17c3b263f813588c432e23424ec306bb268527dc7a09a8423f721b377ed9f8
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB