latrodectus | d83d5378f1bb37d1423207ad67f2f984f2d46ba9534194c344a051117c1e541f

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d83d5378f1bb37d1423207ad67f2f984f2d46ba9534194c344a051117c1e541f.msi
Size

1.4MB
MD5

a32536810939d2264c9030b8a1b12186
SHA1

25b92fa53392d8541c2213769fac25b7ecbc88f1
SHA256

d83d5378f1bb37d1423207ad67f2f984f2d46ba9534194c344a051117c1e541f
SHA512

681c2c3299252ee34e447733e6fd6a00133ade44acac9a46cd2f188fd9f6ea767a183ffc0855e7effd39e1ac873405f2d22a7c44e3ce8e39441119d71841029e
SSDEEP

24576:1hFxLNvYLSMvZCFlp8zBQSc0ZoCvqKwx0ECIgYmfLVYeBZr7AJ/MqYzXZ:1h1vYpW8zBQSc0ZnSKeZKumZr7Amqg

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

https://titnovacrion.top/live/

https://grunzalom.fun/live/

Signatures

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Detect larodectus Loader variant 2 4 IoCs

loader

resource	yara_rule
behavioral2/memory/3248-48-0x000001EA5AD90000-0x000001EA5ADA4000-memory.dmp	family_latrodectus_v2
behavioral2/memory/3248-52-0x000001EA5AD90000-0x000001EA5ADA4000-memory.dmp	family_latrodectus_v2
behavioral2/memory/3016-65-0x00000216FFC70000-0x00000216FFC84000-memory.dmp	family_latrodectus_v2
behavioral2/memory/3016-66-0x00000216FFC70000-0x00000216FFC84000-memory.dmp	family_latrodectus_v2

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIE177.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE2A0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE3EA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE448.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57e109.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EDB05111-9E1F-4247-A9B5-3D72B974D151}	msiexec.exe
File created	C:\Windows\Installer\e57e109.msi	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
1500	MSIE448.tmp

Loads dropped DLL 10 IoCs

pid	Process
3152	MsiExec.exe
3152	MsiExec.exe
3152	MsiExec.exe
3152	MsiExec.exe
3152	MsiExec.exe
3152	MsiExec.exe
3108	MsiExec.exe
3108	MsiExec.exe
3248	rundll32.exe
3016	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000008fdc540eeb98985f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800008fdc540e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809008fdc540e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d8fdc540e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000008fdc540e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2808	msiexec.exe
2808	msiexec.exe
1500	MSIE448.tmp
1500	MSIE448.tmp
3248	rundll32.exe
3248	rundll32.exe
3248	rundll32.exe
3248	rundll32.exe
3016	rundll32.exe
3016	rundll32.exe
3016	rundll32.exe
3016	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2228	msiexec.exe
Token: SeSecurityPrivilege	2808	msiexec.exe
Token: SeCreateTokenPrivilege	2228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2228	msiexec.exe
Token: SeLockMemoryPrivilege	2228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2228	msiexec.exe
Token: SeMachineAccountPrivilege	2228	msiexec.exe
Token: SeTcbPrivilege	2228	msiexec.exe
Token: SeSecurityPrivilege	2228	msiexec.exe
Token: SeTakeOwnershipPrivilege	2228	msiexec.exe
Token: SeLoadDriverPrivilege	2228	msiexec.exe
Token: SeSystemProfilePrivilege	2228	msiexec.exe
Token: SeSystemtimePrivilege	2228	msiexec.exe
Token: SeProfSingleProcessPrivilege	2228	msiexec.exe
Token: SeIncBasePriorityPrivilege	2228	msiexec.exe
Token: SeCreatePagefilePrivilege	2228	msiexec.exe
Token: SeCreatePermanentPrivilege	2228	msiexec.exe
Token: SeBackupPrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeShutdownPrivilege	2228	msiexec.exe
Token: SeDebugPrivilege	2228	msiexec.exe
Token: SeAuditPrivilege	2228	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2228	msiexec.exe
Token: SeChangeNotifyPrivilege	2228	msiexec.exe
Token: SeRemoteShutdownPrivilege	2228	msiexec.exe
Token: SeUndockPrivilege	2228	msiexec.exe
Token: SeSyncAgentPrivilege	2228	msiexec.exe
Token: SeEnableDelegationPrivilege	2228	msiexec.exe
Token: SeManageVolumePrivilege	2228	msiexec.exe
Token: SeImpersonatePrivilege	2228	msiexec.exe
Token: SeCreateGlobalPrivilege	2228	msiexec.exe
Token: SeCreateTokenPrivilege	2228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2228	msiexec.exe
Token: SeLockMemoryPrivilege	2228	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2228	msiexec.exe
Token: SeMachineAccountPrivilege	2228	msiexec.exe
Token: SeTcbPrivilege	2228	msiexec.exe
Token: SeSecurityPrivilege	2228	msiexec.exe
Token: SeTakeOwnershipPrivilege	2228	msiexec.exe
Token: SeLoadDriverPrivilege	2228	msiexec.exe
Token: SeSystemProfilePrivilege	2228	msiexec.exe
Token: SeSystemtimePrivilege	2228	msiexec.exe
Token: SeProfSingleProcessPrivilege	2228	msiexec.exe
Token: SeIncBasePriorityPrivilege	2228	msiexec.exe
Token: SeCreatePagefilePrivilege	2228	msiexec.exe
Token: SeCreatePermanentPrivilege	2228	msiexec.exe
Token: SeBackupPrivilege	2228	msiexec.exe
Token: SeRestorePrivilege	2228	msiexec.exe
Token: SeShutdownPrivilege	2228	msiexec.exe
Token: SeDebugPrivilege	2228	msiexec.exe
Token: SeAuditPrivilege	2228	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2228	msiexec.exe
Token: SeChangeNotifyPrivilege	2228	msiexec.exe
Token: SeRemoteShutdownPrivilege	2228	msiexec.exe
Token: SeUndockPrivilege	2228	msiexec.exe
Token: SeSyncAgentPrivilege	2228	msiexec.exe
Token: SeEnableDelegationPrivilege	2228	msiexec.exe
Token: SeManageVolumePrivilege	2228	msiexec.exe
Token: SeImpersonatePrivilege	2228	msiexec.exe
Token: SeCreateGlobalPrivilege	2228	msiexec.exe
Token: SeCreateTokenPrivilege	2228	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2228	msiexec.exe
Token: SeLockMemoryPrivilege	2228	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2228	msiexec.exe
2228	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3152	2808	msiexec.exe	92
PID 2808 wrote to memory of 3152	2808	msiexec.exe	92
PID 2808 wrote to memory of 3152	2808	msiexec.exe	92
PID 2808 wrote to memory of 440	2808	msiexec.exe	109
PID 2808 wrote to memory of 440	2808	msiexec.exe	109
PID 2808 wrote to memory of 3108	2808	msiexec.exe	111
PID 2808 wrote to memory of 3108	2808	msiexec.exe	111
PID 2808 wrote to memory of 3108	2808	msiexec.exe	111
PID 2808 wrote to memory of 1500	2808	msiexec.exe	112
PID 2808 wrote to memory of 1500	2808	msiexec.exe	112
PID 2808 wrote to memory of 1500	2808	msiexec.exe	112
PID 3248 wrote to memory of 3016	3248	rundll32.exe	114
PID 3248 wrote to memory of 3016	3248	rundll32.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\d83d5378f1bb37d1423207ad67f2f984f2d46ba9534194c344a051117c1e541f.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2228

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 74388E247F37529B40C90C589FD76A03 C
  2⤵
  - Loads dropped DLL
  PID:3152
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:440
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8715C57AD31266058E1F0CA6C931178A
  2⤵
  - Loads dropped DLL
  PID:3108
- C:\Windows\Installer\MSIE448.tmp
  "C:\Windows\Installer\MSIE448.tmp" C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\besr\cr2.dll, vgml
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2396

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\besr\cr2.dll, vgml
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\System32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_660c9e20.dll", vgml
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57e10a.rbs

Filesize
1KB

MD5
cff452acfa8e8ed39951d4adc4ddc20e

SHA1
1331278c2dfdb693cfcd3d35d2236ddff40f0217

SHA256
e1da748c02784586aabb00a2f15cb5eb0243594154565e4660543977add53c15

SHA512
3c94f5cef07c2d8b545d21f4f8f0ccd98b24e2c137ffcdb9505f6d75369b83976c92d96a079e0477435e6587fa45b16f37c47c533fabb8465f3fcc86f010f804

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI5F95.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Users\Admin\AppData\Local\besr\cr2.dll

Filesize
277KB

MD5
f9425561701935d358f4f5b7fc2e5502

SHA1
f00b5a6bbd7f500c439bfa4e4dedc79850732597

SHA256
71fb25cc4c05ce9dd94614ed781d85a50dccf69042521abc6782d48df85e6de9

SHA512
8faa2b11ca95eed4b7d5aa7dcc36669d929e7d2c503714d7d220c660e9dad8aa92697f57080fa7589875fe36e3fa9b507e96970d9647373c82969c7972774bcb

Download Submit
C:\Windows\Installer\MSIE448.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
6.9MB

MD5
f1e86ccc61266968811501736c6be2bb

SHA1
96a38cec9ba87f0a6876b98a9eae911eb3a473df

SHA256
f539365ed70df5fcb3692a25a3299f6756daa09479a5bf8a32f79d0e5c2b299a

SHA512
87a37f1db78664ca4eb82f746cb8adfa956b47d0e37cdaa406cebb401709fcd60e81d14ea008df347d6d6da3f8a5cb3d2bd0e29002e9a168af67ad0f58e371ee

Download Submit
\??\Volume{0e54dc8f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{20952857-4a34-4fea-9017-76871d1cea24}_OnDiskSnapshotProp

Filesize
6KB

MD5
8586cb9862a138bc962abc64ad985399

SHA1
451137b475a269e100d1fafa33eed555b8d94b16

SHA256
f7746e71b9f0fe11583e1a781e47db02d2199e93d3cb90be5d38b78259998f04

SHA512
e9d3665cd723a2b44ac90e847b50ac5e57706ec04f26d0d69057e5d5c3b29ea4b6be098ba53eab2e09ebf8748fd56ecad6d937a95ed36ff39d09f58a0c9116e0

Download Submit
memory/3016-65-0x00000216FFC70000-0x00000216FFC84000-memory.dmp

Filesize
80KB

Download
memory/3016-66-0x00000216FFC70000-0x00000216FFC84000-memory.dmp

Filesize
80KB

Download
memory/3248-47-0x000001EA5AD50000-0x000001EA5AD82000-memory.dmp

Filesize
200KB

Download
memory/3248-48-0x000001EA5AD90000-0x000001EA5ADA4000-memory.dmp

Filesize
80KB

Download
memory/3248-50-0x00007FFCC8E70000-0x00007FFCC8EBC000-memory.dmp

Filesize
304KB

Download
memory/3248-52-0x000001EA5AD90000-0x000001EA5ADA4000-memory.dmp

Filesize
80KB

Download