Overview

overview

10

Static

static

7

010f7076c3...18.exe

windows7-x64

10

010f7076c3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    010f7076c3a90ec57300c54d082f5455_JaffaCakes118

  • Size

    336KB

  • Sample

    240622-dxd4javhrc

  • MD5

    010f7076c3a90ec57300c54d082f5455

  • SHA1

    091d737683a1b145d4cc94545eeb260c5a9ef69e

  • SHA256

    edb0003ee578690cc3a457511660c6c8d80597af4e5cd364ccc99e2135a6bf37

  • SHA512

    ce876c3de91c91f2294b0d0a0e0ef7e3d220749d93f90c4f6a7fab0a003f49870f9ef6b37a18cc1abc0af01b12811d0ac5c0d3456cf8765e175c97135485e0ab

  • SSDEEP

    6144:m36NMuxI3F8J4KWjPoxl2seC7mrbwqhBwgojh/5KijGhPVtezdrpT2s0syVroS:m36NMuxz+KUP8XeCKgo2gGBrMVtehpbM

Score
10/10
latentbotevasionpersistencetrojanupx

Malware Config

Extracted

Family

latentbot

C2

pertenemene.zapto.org

1pertenemene.zapto.org

2pertenemene.zapto.org

3pertenemene.zapto.org

4pertenemene.zapto.org

5pertenemene.zapto.org

6pertenemene.zapto.org

7pertenemene.zapto.org

8pertenemene.zapto.org

Targets

    • Target

      010f7076c3a90ec57300c54d082f5455_JaffaCakes118

    • Size

      336KB

    • MD5

      010f7076c3a90ec57300c54d082f5455

    • SHA1

      091d737683a1b145d4cc94545eeb260c5a9ef69e

    • SHA256

      edb0003ee578690cc3a457511660c6c8d80597af4e5cd364ccc99e2135a6bf37

    • SHA512

      ce876c3de91c91f2294b0d0a0e0ef7e3d220749d93f90c4f6a7fab0a003f49870f9ef6b37a18cc1abc0af01b12811d0ac5c0d3456cf8765e175c97135485e0ab

    • SSDEEP

      6144:m36NMuxI3F8J4KWjPoxl2seC7mrbwqhBwgojh/5KijGhPVtezdrpT2s0syVroS:m36NMuxz+KUP8XeCKgo2gGBrMVtehpbM

    Score
    10/10
    latentbotevasionpersistencetrojanupx

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

      trojanlatentbot

    • Modifies firewall policy service

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks