latrodectus | d7056dfce17c0f4c51d35bd23eca5eedd591f35a7ca468d5aa1e42e7f08fbef2

Resubmissions

05-04-2024 15:25

13-02-2024 16:39

Score

10^/10

Family

latrodectus

https://plwskoret.top/live/

https://miistoria.com/live/

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Detect larodectus Loader variant 1 2 IoCs

loader

resource	yara_rule
behavioral1/memory/2288-0-0x0000000000190000-0x00000000001A3000-memory.dmp	family_latrodectus_v1
behavioral1/memory/2288-1-0x0000000000190000-0x00000000001A3000-memory.dmp	family_latrodectus_v1

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2288	rundll32.exe
2288	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2288	2908	cmd.exe	29
PID 2908 wrote to memory of 2288	2908	cmd.exe	29
PID 2908 wrote to memory of 2288	2908	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\launcher.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\rundll32.exe
  rundll32.exe setordinal.dll,bhuf
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2288

memory/2288-0-0x0000000000190000-0x00000000001A3000-memory.dmp

Filesize
76KB

Download
memory/2288-1-0x0000000000190000-0x00000000001A3000-memory.dmp

Filesize
76KB

Download