latentbot | a315204712fa9e07e1aaf5e06b80c449d83faacdd570e17b8731db24864fc0d7

Analysis

max time kernel
294s
max time network
293s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
01/10/2025, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NFE_5633969846112655412413290377898720450078.vbs
Size 6.2MB
Sample251001-fbq73sap2s
SHA256 90069d0c422b3447a106fe799f058394d5571f21270053a106f39fb6352afb83
MD5 99bd5e134bbeb90d08c7bfc4a3a5c4cd
SHA1 95f2a4d0d12c58ad37a286692e362d543b0300b9
SHA512 e8aafe530198f3afb6ea2f28d07cb9ad9bc66da5e47f9129d33cc02906e75121686fdc11a4e511ddb033ed405f38bdc11a729d3f19d77616cce3547a7c97158e
SSDEEP 49152:2gP8w5ryAOjms0oCCI7DXgJH8INnRL2OiBcdm1Lf7geqLjDvT3/+5gcfTHJ1EVc+:I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution latentbot persistence trojan

Malware Config

Signatures

LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot
Latentbot family
latentbot

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1000	WScript.exe
3	1000	WScript.exe
4	1000	WScript.exe
5	1000	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
4424	kXh5D7wvA3Vd

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kXh5D7wvA3Vd

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5796	schtasks.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 5796	1000	WScript.exe	78
PID 1000 wrote to memory of 5796	1000	WScript.exe	78

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\NFE_5633969846112655412413290377898720450078.vbs"
1⤵
- Badlisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn "EdgeUpdatehp" /tr "C:\Users\Admin\kXh5D7wvA3Vd" /sc minute /mo 5 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5796

C:\Users\Admin\kXh5D7wvA3Vd
C:\Users\Admin\kXh5D7wvA3Vd
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hpt

Path C:\Users\Admin\hpt
Size 61B
SHA256 a402c6be0e5a5261e3479fa708433d7f22ad3fbddedc99f535ffcad740ca709f
MD5 e5fbc4574f69ac67566102da4a5679ee
SHA1 2b0449fb077a3347e34ef2f7d35f495cb3aeab17
SHA512 cd27158373ac00ca360c7244863f8ebc7ce2e8079b704832e9a6f6beee19371a066b74ccb81de152e053683e77e4dbd86504ad5b2701732a78281b98831236ce
MD5 SHA1 SHA512

Submit Download

kXh5D7wvA3Vd

Path C:\Users\Admin\kXh5D7wvA3Vd
Size 2.4MB
SHA256 72470e125fd1927b95167249213f872fc7fc0705f643650b613c2c7a00fb7ecc
MD5 0af28d119d0fb6286e0b03f3720ee98e
SHA1 812a21661180bad740a6e4c79a24390369d9301b
SHA512 92261131d4b80577b30f5c00083a5a1c277a446f51dbea5d5a518e378f120cee57b8eadc54bc87c7d26242604ef5dcb9010eeecddf880f5cf05428ce52f83df3
SSDEEP 49152:RnZWa75kKyByS97taOJpj535S/IT4qFn/vx:RZ175kxpgRs/vx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4424-12-0x0000000000629000-0x000000000062B000-memory.dmp

Download

memory/4424-13-0x0000000000400000-0x0000000000673000-memory.dmp

Download

memory/4424-15-0x0000000000400000-0x0000000000673000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads