Analysis
-
max time kernel
1200s -
max time network
1204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 19:10
Static task
static1
Behavioral task
behavioral1
Sample
upd.msi
Resource
win7-20240221-en
windows7-x64
12 signatures
1200 seconds
Behavioral task
behavioral2
Sample
upd.msi
Resource
win10-20240221-en
windows10-1703-x64
13 signatures
1200 seconds
Behavioral task
behavioral3
Sample
upd.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
1200 seconds
General
-
Target
upd.msi
-
Size
1.4MB
-
MD5
a32536810939d2264c9030b8a1b12186
-
SHA1
25b92fa53392d8541c2213769fac25b7ecbc88f1
-
SHA256
d83d5378f1bb37d1423207ad67f2f984f2d46ba9534194c344a051117c1e541f
-
SHA512
681c2c3299252ee34e447733e6fd6a00133ade44acac9a46cd2f188fd9f6ea767a183ffc0855e7effd39e1ac873405f2d22a7c44e3ce8e39441119d71841029e
-
SSDEEP
24576:1hFxLNvYLSMvZCFlp8zBQSc0ZoCvqKwx0ECIgYmfLVYeBZr7AJ/MqYzXZ:1h1vYpW8zBQSc0ZnSKeZKumZr7Amqg
Score
10/10
Malware Config
Extracted
Family
latrodectus
C2
https://titnovacrion.top/live/
https://grunzalom.fun/live/
Signatures
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Detect larodectus Loader variant 2 4 IoCs
resource yara_rule behavioral3/memory/4116-48-0x0000010D14160000-0x0000010D14174000-memory.dmp family_latrodectus_v2 behavioral3/memory/4116-53-0x0000010D14160000-0x0000010D14174000-memory.dmp family_latrodectus_v2 behavioral3/memory/1536-65-0x00000165560F0000-0x0000016556104000-memory.dmp family_latrodectus_v2 behavioral3/memory/1536-66-0x00000165560F0000-0x0000016556104000-memory.dmp family_latrodectus_v2 -
Blocklisted process makes network request 64 IoCs
flow pid Process 149 1536 rundll32.exe 151 1536 rundll32.exe 153 1536 rundll32.exe 154 1536 rundll32.exe 155 1536 rundll32.exe 156 1536 rundll32.exe 157 1536 rundll32.exe 159 1536 rundll32.exe 160 1536 rundll32.exe 161 1536 rundll32.exe 163 1536 rundll32.exe 164 1536 rundll32.exe 165 1536 rundll32.exe 166 1536 rundll32.exe 167 1536 rundll32.exe 168 1536 rundll32.exe 169 1536 rundll32.exe 171 1536 rundll32.exe 172 1536 rundll32.exe 173 1536 rundll32.exe 174 1536 rundll32.exe 175 1536 rundll32.exe 176 1536 rundll32.exe 178 1536 rundll32.exe 179 1536 rundll32.exe 180 1536 rundll32.exe 181 1536 rundll32.exe 183 1536 rundll32.exe 185 1536 rundll32.exe 187 1536 rundll32.exe 188 1536 rundll32.exe 189 1536 rundll32.exe 190 1536 rundll32.exe 191 1536 rundll32.exe 194 1536 rundll32.exe 195 1536 rundll32.exe 196 1536 rundll32.exe 197 1536 rundll32.exe 198 1536 rundll32.exe 199 1536 rundll32.exe 200 1536 rundll32.exe 202 1536 rundll32.exe 204 1536 rundll32.exe 205 1536 rundll32.exe 206 1536 rundll32.exe 207 1536 rundll32.exe 208 1536 rundll32.exe 210 1536 rundll32.exe 211 1536 rundll32.exe 212 1536 rundll32.exe 213 1536 rundll32.exe 214 1536 rundll32.exe 215 1536 rundll32.exe 217 1536 rundll32.exe 219 1536 rundll32.exe 220 1536 rundll32.exe 221 1536 rundll32.exe 222 1536 rundll32.exe 224 1536 rundll32.exe 225 1536 rundll32.exe 226 1536 rundll32.exe 227 1536 rundll32.exe 228 1536 rundll32.exe 229 1536 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIDE8B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDF09.tmp msiexec.exe File created C:\Windows\Installer\e57dbe9.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{EDB05111-9E1F-4247-A9B5-3D72B974D151} msiexec.exe File opened for modification C:\Windows\Installer\e57dbe9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIDC95.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDD13.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 4820 MSIDF09.tmp -
Loads dropped DLL 10 IoCs
pid Process 4312 MsiExec.exe 4312 MsiExec.exe 4312 MsiExec.exe 4312 MsiExec.exe 4312 MsiExec.exe 4312 MsiExec.exe 3124 MsiExec.exe 3124 MsiExec.exe 4116 rundll32.exe 1536 rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007d3392e9fd415b840000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007d3392e90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809007d3392e9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7d3392e9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007d3392e900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4552 msiexec.exe 4552 msiexec.exe 4820 MSIDF09.tmp 4820 MSIDF09.tmp 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 4116 rundll32.exe 1536 rundll32.exe 1536 rundll32.exe 1536 rundll32.exe 1536 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 908 msiexec.exe Token: SeIncreaseQuotaPrivilege 908 msiexec.exe Token: SeSecurityPrivilege 4552 msiexec.exe Token: SeCreateTokenPrivilege 908 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 908 msiexec.exe Token: SeLockMemoryPrivilege 908 msiexec.exe Token: SeIncreaseQuotaPrivilege 908 msiexec.exe Token: SeMachineAccountPrivilege 908 msiexec.exe Token: SeTcbPrivilege 908 msiexec.exe Token: SeSecurityPrivilege 908 msiexec.exe Token: SeTakeOwnershipPrivilege 908 msiexec.exe Token: SeLoadDriverPrivilege 908 msiexec.exe Token: SeSystemProfilePrivilege 908 msiexec.exe Token: SeSystemtimePrivilege 908 msiexec.exe Token: SeProfSingleProcessPrivilege 908 msiexec.exe Token: SeIncBasePriorityPrivilege 908 msiexec.exe Token: SeCreatePagefilePrivilege 908 msiexec.exe Token: SeCreatePermanentPrivilege 908 msiexec.exe Token: SeBackupPrivilege 908 msiexec.exe Token: SeRestorePrivilege 908 msiexec.exe Token: SeShutdownPrivilege 908 msiexec.exe Token: SeDebugPrivilege 908 msiexec.exe Token: SeAuditPrivilege 908 msiexec.exe Token: SeSystemEnvironmentPrivilege 908 msiexec.exe Token: SeChangeNotifyPrivilege 908 msiexec.exe Token: SeRemoteShutdownPrivilege 908 msiexec.exe Token: SeUndockPrivilege 908 msiexec.exe Token: SeSyncAgentPrivilege 908 msiexec.exe Token: SeEnableDelegationPrivilege 908 msiexec.exe Token: SeManageVolumePrivilege 908 msiexec.exe Token: SeImpersonatePrivilege 908 msiexec.exe Token: SeCreateGlobalPrivilege 908 msiexec.exe Token: SeCreateTokenPrivilege 908 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 908 msiexec.exe Token: SeLockMemoryPrivilege 908 msiexec.exe Token: SeIncreaseQuotaPrivilege 908 msiexec.exe Token: SeMachineAccountPrivilege 908 msiexec.exe Token: SeTcbPrivilege 908 msiexec.exe Token: SeSecurityPrivilege 908 msiexec.exe Token: SeTakeOwnershipPrivilege 908 msiexec.exe Token: SeLoadDriverPrivilege 908 msiexec.exe Token: SeSystemProfilePrivilege 908 msiexec.exe Token: SeSystemtimePrivilege 908 msiexec.exe Token: SeProfSingleProcessPrivilege 908 msiexec.exe Token: SeIncBasePriorityPrivilege 908 msiexec.exe Token: SeCreatePagefilePrivilege 908 msiexec.exe Token: SeCreatePermanentPrivilege 908 msiexec.exe Token: SeBackupPrivilege 908 msiexec.exe Token: SeRestorePrivilege 908 msiexec.exe Token: SeShutdownPrivilege 908 msiexec.exe Token: SeDebugPrivilege 908 msiexec.exe Token: SeAuditPrivilege 908 msiexec.exe Token: SeSystemEnvironmentPrivilege 908 msiexec.exe Token: SeChangeNotifyPrivilege 908 msiexec.exe Token: SeRemoteShutdownPrivilege 908 msiexec.exe Token: SeUndockPrivilege 908 msiexec.exe Token: SeSyncAgentPrivilege 908 msiexec.exe Token: SeEnableDelegationPrivilege 908 msiexec.exe Token: SeManageVolumePrivilege 908 msiexec.exe Token: SeImpersonatePrivilege 908 msiexec.exe Token: SeCreateGlobalPrivilege 908 msiexec.exe Token: SeCreateTokenPrivilege 908 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 908 msiexec.exe Token: SeLockMemoryPrivilege 908 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 908 msiexec.exe 908 msiexec.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4552 wrote to memory of 4312 4552 msiexec.exe 91 PID 4552 wrote to memory of 4312 4552 msiexec.exe 91 PID 4552 wrote to memory of 4312 4552 msiexec.exe 91 PID 4552 wrote to memory of 3428 4552 msiexec.exe 104 PID 4552 wrote to memory of 3428 4552 msiexec.exe 104 PID 4552 wrote to memory of 3124 4552 msiexec.exe 106 PID 4552 wrote to memory of 3124 4552 msiexec.exe 106 PID 4552 wrote to memory of 3124 4552 msiexec.exe 106 PID 4552 wrote to memory of 4820 4552 msiexec.exe 108 PID 4552 wrote to memory of 4820 4552 msiexec.exe 108 PID 4552 wrote to memory of 4820 4552 msiexec.exe 108 PID 4116 wrote to memory of 1536 4116 rundll32.exe 110 PID 4116 wrote to memory of 1536 4116 rundll32.exe 110 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\upd.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:908
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9AAB4C270C9A44CCD4932920468320C8 C2⤵
- Loads dropped DLL
PID:4312
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3428
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9E9F539FF20A012D42F13A106F15D7132⤵
- Loads dropped DLL
PID:3124
-
-
C:\Windows\Installer\MSIDF09.tmp"C:\Windows\Installer\MSIDF09.tmp" C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\besr\cr2.dll, vgml2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4820
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:3660
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\besr\cr2.dll, vgml1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\System32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_7313c66e.dll", vgml2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b6093023268cd3077bc80365d7f78e2e
SHA170b582454d5bf4138fc81feb37e2138b41028c8d
SHA256d9b76f8955f902d16558806eb4adce3cb4802cb2a8ac0bfdfabb6874955afc3d
SHA512106f1380b4c3406e21a9f5f8bec745b2a69077dfe7fa774411a1c863d540c32a9ec6481dca90a30406656d4ccb0a1798635e2e6f6403d03e62fafa3331e4a008
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
277KB
MD5f9425561701935d358f4f5b7fc2e5502
SHA1f00b5a6bbd7f500c439bfa4e4dedc79850732597
SHA25671fb25cc4c05ce9dd94614ed781d85a50dccf69042521abc6782d48df85e6de9
SHA5128faa2b11ca95eed4b7d5aa7dcc36669d929e7d2c503714d7d220c660e9dad8aa92697f57080fa7589875fe36e3fa9b507e96970d9647373c82969c7972774bcb
-
Filesize
209KB
MD50496fa31807a9ef6297550fe84568fe8
SHA1aa8d1d8a086541c41a5d2452ba7baa8032eca6b6
SHA2567c5f7ba29e2d6bfcf148a338b9a1e87edf2151d4fe18e97fdc2fd227f42134f6
SHA5122528ed73b2621229cab1f94275e50893fc88d275e4525450e3e1d81caf6707b7c81956fde326776874679da9d3731aa7008db47fcf4bd2691d22d63b0683db86
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
-
Filesize
23.7MB
MD53f97600b3720452c2da74efb7d484ca7
SHA1082fe83089f633da6294e5d98b582a8c82ef01ef
SHA256e005c44a358875c25e1a50ccda41a953ea020439aa6ffb55c499d396d64a84e4
SHA512b0f05111321b303b8fbd8a4999779a7b7424dee4886e347e719cb6207ac9c47c63bf8d331df6222be98765349b3eecca76d49ea932fcc02bb3f7305633886870
-
\??\Volume{e992337d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{753ac803-3bbb-481f-ad72-f9eabe9a1e5d}_OnDiskSnapshotProp
Filesize6KB
MD5a4e9b5dfcb225837a057cf6c855fde79
SHA170f67e9dabfa0dbc309bb1bf34066f5a52023953
SHA256c1220ef3f512d783591a9dead32ea0e7bf432310eb0b014ad7d84632a7917aa2
SHA512b543e4b42aeeab3c2a4a9c155c29dae92160c26df1c480b179b958a50a97f3d74c6417687a83969304cbc74c3205fc738d974934b015f6223af1a37e8180a8ad