latrodectus | b83f12387a8c3bd5d2f7b23a4019b85771bd49fa4f61943771d4e7c6d3e72be5

Resubmissions

05/04/2024, 15:15

240405-snc77sfh55 10

12/03/2024, 09:50

240312-lveahsfh28 7

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
submitted
12/03/2024, 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567.dll

Score

10^/10

latrodectus defense_evasion loader

Malware Config

Extracted

Family

latrodectus

https://scifimond.com/live/

https://drifajizo.fun/live/

Signatures

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Detect larodectus Loader variant 2 3 IoCs

loader

resource	yara_rule
behavioral1/memory/1312-0-0x0000000000130000-0x0000000000144000-memory.dmp	family_latrodectus_v2
behavioral1/memory/2724-3-0x00000000003C0000-0x00000000003D4000-memory.dmp	family_latrodectus_v2
behavioral1/memory/2724-2-0x00000000003C0000-0x00000000003D4000-memory.dmp	family_latrodectus_v2

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
2628	verclsid.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2724	rundll32.exe
2724	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2724	2756	cmd.exe	33
PID 2756 wrote to memory of 2724	2756	cmd.exe	33
PID 2756 wrote to memory of 2724	2756	cmd.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567.dll,#1
1⤵
PID:1312

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:2628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\system32\rundll32.exe
  rundll32 3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567.dll, vgml
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-0-0x0000000000130000-0x0000000000144000-memory.dmp

Filesize
80KB

Download
memory/1312-1-0x0000000000130000-0x0000000000144000-memory.dmp

Filesize
80KB

Download
memory/2724-3-0x00000000003C0000-0x00000000003D4000-memory.dmp

Filesize
80KB

Download
memory/2724-2-0x00000000003C0000-0x00000000003D4000-memory.dmp

Filesize
80KB

Download