latrodectus | 0f0757d1baa3bd0341d282bb0afcdbdb522676db05814a3c3051c08829151b52

Resubmissions

02-04-2024 20:58

240402-zr8lvadd93 10

01-04-2024 22:38

240401-2ksyxshf68 10

01-04-2024 22:32

240401-2f8tksha31 10

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-04-2024 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib.msi
Size

1.5MB
MD5

e1692df23c8753b5744c77570aca2f2e
SHA1

71a71557601602427c80021acb978cccb78e1536
SHA256

0f0757d1baa3bd0341d282bb0afcdbdb522676db05814a3c3051c08829151b52
SHA512

4ce5eba6204ff771fa65e102529580c67076aa7906d38f240c3caf49e4ba35633384015db2ac63c4b29f340152bc6720fcec4d7e42dfdab8c21c4c6659ee5504
SSDEEP

24576:SwRxLNvYLSMvZCFlp8zBQSc0ZoCvqKwx0ECIgYmfLVYeBZr7AuSqTicJ2I0x:SwxvYpW8zBQSc0ZnSKeZKumZr7AjqAI0

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

https://titnovacrion.top/live/

https://skinnyjeanso.com/live/

Signatures

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Detect larodectus Loader variant 2 8 IoCs

loader

resource	yara_rule
behavioral2/memory/4572-49-0x0000023C4FBE0000-0x0000023C4FBF4000-memory.dmp	family_latrodectus_v2
behavioral2/memory/4572-48-0x0000023C4FC00000-0x0000023C4FC14000-memory.dmp	family_latrodectus_v2
behavioral2/memory/4572-50-0x0000023C4FC00000-0x0000023C4FC14000-memory.dmp	family_latrodectus_v2
behavioral2/memory/4572-56-0x0000023C4FC00000-0x0000023C4FC14000-memory.dmp	family_latrodectus_v2
behavioral2/memory/1044-69-0x000001E428F00000-0x000001E428F14000-memory.dmp	family_latrodectus_v2
behavioral2/memory/1044-70-0x000001E428EE0000-0x000001E428EF4000-memory.dmp	family_latrodectus_v2
behavioral2/memory/1044-71-0x000001E428F00000-0x000001E428F14000-memory.dmp	family_latrodectus_v2
behavioral2/memory/1044-72-0x000001E428F00000-0x000001E428F14000-memory.dmp	family_latrodectus_v2

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI80B9.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8203.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8271.tmp	msiexec.exe
File created	C:\Windows\Installer\e57807a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8137.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9AC22351-D2AA-4C6B-8AA9-A2E8BE2FF4E0}	msiexec.exe
File opened for modification	C:\Windows\Installer\e57807a.msi	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
1036	MSI8271.tmp

Loads dropped DLL 10 IoCs

pid	Process
4728	MsiExec.exe
4728	MsiExec.exe
4728	MsiExec.exe
4728	MsiExec.exe
4728	MsiExec.exe
4728	MsiExec.exe
4944	MsiExec.exe
4944	MsiExec.exe
4572	rundll32.exe
1044	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007667065a040ee7130000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007667065a0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809007667065a000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d7667065a000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007667065a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1424	msiexec.exe
1424	msiexec.exe
1036	MSI8271.tmp
1036	MSI8271.tmp
4572	rundll32.exe
4572	rundll32.exe
4572	rundll32.exe
4572	rundll32.exe
1044	rundll32.exe
1044	rundll32.exe
1044	rundll32.exe
1044	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2024	msiexec.exe
Token: SeSecurityPrivilege	1424	msiexec.exe
Token: SeCreateTokenPrivilege	2024	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2024	msiexec.exe
Token: SeLockMemoryPrivilege	2024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2024	msiexec.exe
Token: SeMachineAccountPrivilege	2024	msiexec.exe
Token: SeTcbPrivilege	2024	msiexec.exe
Token: SeSecurityPrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeLoadDriverPrivilege	2024	msiexec.exe
Token: SeSystemProfilePrivilege	2024	msiexec.exe
Token: SeSystemtimePrivilege	2024	msiexec.exe
Token: SeProfSingleProcessPrivilege	2024	msiexec.exe
Token: SeIncBasePriorityPrivilege	2024	msiexec.exe
Token: SeCreatePagefilePrivilege	2024	msiexec.exe
Token: SeCreatePermanentPrivilege	2024	msiexec.exe
Token: SeBackupPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeShutdownPrivilege	2024	msiexec.exe
Token: SeDebugPrivilege	2024	msiexec.exe
Token: SeAuditPrivilege	2024	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2024	msiexec.exe
Token: SeChangeNotifyPrivilege	2024	msiexec.exe
Token: SeRemoteShutdownPrivilege	2024	msiexec.exe
Token: SeUndockPrivilege	2024	msiexec.exe
Token: SeSyncAgentPrivilege	2024	msiexec.exe
Token: SeEnableDelegationPrivilege	2024	msiexec.exe
Token: SeManageVolumePrivilege	2024	msiexec.exe
Token: SeImpersonatePrivilege	2024	msiexec.exe
Token: SeCreateGlobalPrivilege	2024	msiexec.exe
Token: SeCreateTokenPrivilege	2024	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2024	msiexec.exe
Token: SeLockMemoryPrivilege	2024	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2024	msiexec.exe
Token: SeMachineAccountPrivilege	2024	msiexec.exe
Token: SeTcbPrivilege	2024	msiexec.exe
Token: SeSecurityPrivilege	2024	msiexec.exe
Token: SeTakeOwnershipPrivilege	2024	msiexec.exe
Token: SeLoadDriverPrivilege	2024	msiexec.exe
Token: SeSystemProfilePrivilege	2024	msiexec.exe
Token: SeSystemtimePrivilege	2024	msiexec.exe
Token: SeProfSingleProcessPrivilege	2024	msiexec.exe
Token: SeIncBasePriorityPrivilege	2024	msiexec.exe
Token: SeCreatePagefilePrivilege	2024	msiexec.exe
Token: SeCreatePermanentPrivilege	2024	msiexec.exe
Token: SeBackupPrivilege	2024	msiexec.exe
Token: SeRestorePrivilege	2024	msiexec.exe
Token: SeShutdownPrivilege	2024	msiexec.exe
Token: SeDebugPrivilege	2024	msiexec.exe
Token: SeAuditPrivilege	2024	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2024	msiexec.exe
Token: SeChangeNotifyPrivilege	2024	msiexec.exe
Token: SeRemoteShutdownPrivilege	2024	msiexec.exe
Token: SeUndockPrivilege	2024	msiexec.exe
Token: SeSyncAgentPrivilege	2024	msiexec.exe
Token: SeEnableDelegationPrivilege	2024	msiexec.exe
Token: SeManageVolumePrivilege	2024	msiexec.exe
Token: SeImpersonatePrivilege	2024	msiexec.exe
Token: SeCreateGlobalPrivilege	2024	msiexec.exe
Token: SeCreateTokenPrivilege	2024	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2024	msiexec.exe
Token: SeLockMemoryPrivilege	2024	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2024	msiexec.exe
2024	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 4728	1424	msiexec.exe	87
PID 1424 wrote to memory of 4728	1424	msiexec.exe	87
PID 1424 wrote to memory of 4728	1424	msiexec.exe	87
PID 1424 wrote to memory of 1164	1424	msiexec.exe	101
PID 1424 wrote to memory of 1164	1424	msiexec.exe	101
PID 1424 wrote to memory of 4944	1424	msiexec.exe	103
PID 1424 wrote to memory of 4944	1424	msiexec.exe	103
PID 1424 wrote to memory of 4944	1424	msiexec.exe	103
PID 1424 wrote to memory of 1036	1424	msiexec.exe	104
PID 1424 wrote to memory of 1036	1424	msiexec.exe	104
PID 1424 wrote to memory of 1036	1424	msiexec.exe	104
PID 4572 wrote to memory of 1044	4572	rundll32.exe	106
PID 4572 wrote to memory of 1044	4572	rundll32.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\lib.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2024

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 85E2260BFE578814C3AECD9740D3ADB7 C
  2⤵
  - Loads dropped DLL
  PID:4728
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1164
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E193A43040503E5CFDED397D07E9293E
  2⤵
  - Loads dropped DLL
  PID:4944
- C:\Windows\Installer\MSI8271.tmp
  "C:\Windows\Installer\MSI8271.tmp" C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\libroffice\rsa.dll, home
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2236

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\libroffice\rsa.dll, home
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\System32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_9729806f.dll", home
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57807b.rbs

Filesize
1KB

MD5
807cb9f21c0f2140a780af8218b5c359

SHA1
1300a2e9d448144b47c4a00818bf6f375ac66686

SHA256
d3cbbd074c470e15015c9ff64c435895d7ac5bd157ed0e67a2eda5336035491a

SHA512
b570183b9ffde55e0be5fa54e69d5ab1eb845dd864b5db8df3fe4c81eb08bece3047fc2d18da3d356365292552c18ff2367e8d81052fda9f5d9585b105463848

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI45A4.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Users\Admin\AppData\Local\libroffice\rsa.dll

Filesize
740KB

MD5
3925637dae8797721f30976e688b84d8

SHA1
e260fc3f8646b605cf05684afca681dc74061efa

SHA256
17ddc339b14845bc9d67c5c3cd9a0e617387cc0569131ff3641035d82043effa

SHA512
7ae16443b752c88a7e9231120cc337bf4c7d05b67daa572771d0daed49e4ee7efec3ec4a64faf8799f69d01b6928d82d9d284d8ccc1410595dafd531fd17e880

Download Submit
C:\Windows\Installer\MSI8271.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
2f6021c6216f4dc732052a0b319e4212

SHA1
45c2a6a29fb44f85ce142d0100d391064b0f8be8

SHA256
c342ba5b4d8dd51d71bdc1cdae40c147e7f52797694c7199311f69db096d9100

SHA512
d1811dbecfb7b774710f749247f4acef876d2cfaa5d3e3895881d94d3ef74366819df48af1629432534a12bd401ea4597ef774dfb6e2d612b78cd6ed5d16d6cb

Download Submit
\??\Volume{5a066776-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5442f970-26f9-4429-834e-0f00fa2f9c16}_OnDiskSnapshotProp

Filesize
6KB

MD5
8d406a4eff6e5e9c3e59d874cfa2126d

SHA1
55942e286f51b43d057c6b4cf689dcd5dba071bc

SHA256
905bbc9ed2b5b16c03513936d5f0bfb27daafe71f13d404fa562cdd356c05c6f

SHA512
9be2eee54f6c8d744f8bc8442398725e2f574b75d518394476dede7124fd831df5d667cee896577b6b66a86a759d444769b5837224e78d318e01c436218d96ee

Download Submit
memory/1044-72-0x000001E428F00000-0x000001E428F14000-memory.dmp

Filesize
80KB

Download
memory/1044-71-0x000001E428F00000-0x000001E428F14000-memory.dmp

Filesize
80KB

Download
memory/1044-70-0x000001E428EE0000-0x000001E428EF4000-memory.dmp

Filesize
80KB

Download
memory/1044-57-0x0000000180000000-0x00000001800BF000-memory.dmp

Filesize
764KB

Download
memory/1044-69-0x000001E428F00000-0x000001E428F14000-memory.dmp

Filesize
80KB

Download
memory/4572-49-0x0000023C4FBE0000-0x0000023C4FBF4000-memory.dmp

Filesize
80KB

Download
memory/4572-56-0x0000023C4FC00000-0x0000023C4FC14000-memory.dmp

Filesize
80KB

Download
memory/4572-54-0x0000000180000000-0x00000001800BF000-memory.dmp

Filesize
764KB

Download
memory/4572-50-0x0000023C4FC00000-0x0000023C4FC14000-memory.dmp

Filesize
80KB

Download
memory/4572-48-0x0000023C4FC00000-0x0000023C4FC14000-memory.dmp

Filesize
80KB

Download
memory/4572-47-0x0000000180000000-0x00000001800BF000-memory.dmp

Filesize
764KB

Download