Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 13:54
Static task
static1
Behavioral task
behavioral1
Sample
2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399.msi
Resource
win7-20240319-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399.msi
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399.msi
-
Size
2.0MB
-
MD5
b13b0cf148e3a25cbad37604956df69d
-
SHA1
b7136c309dd803a1303c6d93c1aafebb00e1b6bd
-
SHA256
2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399
-
SHA512
af79999ff2b12d6fd32fd0fdaf0a69b23f5ad196035d9a521ff959960c29a9ee7a2dd781f8e5cd1b82677554afd370d97bb17d4434e177cc4ef215df08fefd49
-
SSDEEP
24576:fBlIwwkElBoKQs8pRUm6rPtWYW/x91J8/k:fBmQEjoY8Xbm
Score
10/10
Malware Config
Extracted
Family
latrodectus
C2
https://arsimonopa.com/live/
https://lemonimonakio.com/live/
Signatures
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Detect larodectus Loader variant 1 1 IoCs
resource yara_rule behavioral1/memory/1208-60-0x00000000001B0000-0x00000000001C3000-memory.dmp family_latrodectus_v1 -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe -
Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI78B9.tmp-\WixSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI78B9.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\Installer\f7677fe.ipi msiexec.exe File opened for modification C:\Windows\Installer\f7677fe.ipi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\MSI78B9.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI99F0.tmp msiexec.exe File created C:\Windows\Installer\f767800.msi msiexec.exe File opened for modification C:\Windows\Installer\f7677fd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI78B9.tmp msiexec.exe File created C:\Windows\Installer\f7677fd.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI78B9.tmp-\test.old.cs.dll rundll32.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Loads dropped DLL 6 IoCs
pid Process 1944 MsiExec.exe 2192 rundll32.exe 1208 rundll32.exe 1208 rundll32.exe 1208 rundll32.exe 1208 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2212 msiexec.exe 2212 msiexec.exe 1208 rundll32.exe 1208 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1372 msiexec.exe Token: SeIncreaseQuotaPrivilege 1372 msiexec.exe Token: SeRestorePrivilege 2212 msiexec.exe Token: SeTakeOwnershipPrivilege 2212 msiexec.exe Token: SeSecurityPrivilege 2212 msiexec.exe Token: SeCreateTokenPrivilege 1372 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1372 msiexec.exe Token: SeLockMemoryPrivilege 1372 msiexec.exe Token: SeIncreaseQuotaPrivilege 1372 msiexec.exe Token: SeMachineAccountPrivilege 1372 msiexec.exe Token: SeTcbPrivilege 1372 msiexec.exe Token: SeSecurityPrivilege 1372 msiexec.exe Token: SeTakeOwnershipPrivilege 1372 msiexec.exe Token: SeLoadDriverPrivilege 1372 msiexec.exe Token: SeSystemProfilePrivilege 1372 msiexec.exe Token: SeSystemtimePrivilege 1372 msiexec.exe Token: SeProfSingleProcessPrivilege 1372 msiexec.exe Token: SeIncBasePriorityPrivilege 1372 msiexec.exe Token: SeCreatePagefilePrivilege 1372 msiexec.exe Token: SeCreatePermanentPrivilege 1372 msiexec.exe Token: SeBackupPrivilege 1372 msiexec.exe Token: SeRestorePrivilege 1372 msiexec.exe Token: SeShutdownPrivilege 1372 msiexec.exe Token: SeDebugPrivilege 1372 msiexec.exe Token: SeAuditPrivilege 1372 msiexec.exe Token: SeSystemEnvironmentPrivilege 1372 msiexec.exe Token: SeChangeNotifyPrivilege 1372 msiexec.exe Token: SeRemoteShutdownPrivilege 1372 msiexec.exe Token: SeUndockPrivilege 1372 msiexec.exe Token: SeSyncAgentPrivilege 1372 msiexec.exe Token: SeEnableDelegationPrivilege 1372 msiexec.exe Token: SeManageVolumePrivilege 1372 msiexec.exe Token: SeImpersonatePrivilege 1372 msiexec.exe Token: SeCreateGlobalPrivilege 1372 msiexec.exe Token: SeBackupPrivilege 1752 vssvc.exe Token: SeRestorePrivilege 1752 vssvc.exe Token: SeAuditPrivilege 1752 vssvc.exe Token: SeBackupPrivilege 2212 msiexec.exe Token: SeRestorePrivilege 2212 msiexec.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2772 DrvInst.exe Token: SeLoadDriverPrivilege 2772 DrvInst.exe Token: SeLoadDriverPrivilege 2772 DrvInst.exe Token: SeLoadDriverPrivilege 2772 DrvInst.exe Token: SeRestorePrivilege 2212 msiexec.exe Token: SeTakeOwnershipPrivilege 2212 msiexec.exe Token: SeRestorePrivilege 2212 msiexec.exe Token: SeTakeOwnershipPrivilege 2212 msiexec.exe Token: SeRestorePrivilege 2212 msiexec.exe Token: SeTakeOwnershipPrivilege 2212 msiexec.exe Token: SeRestorePrivilege 2212 msiexec.exe Token: SeTakeOwnershipPrivilege 2212 msiexec.exe Token: SeRestorePrivilege 2212 msiexec.exe Token: SeTakeOwnershipPrivilege 2212 msiexec.exe Token: SeRestorePrivilege 2212 msiexec.exe Token: SeTakeOwnershipPrivilege 2212 msiexec.exe Token: SeRestorePrivilege 2212 msiexec.exe Token: SeTakeOwnershipPrivilege 2212 msiexec.exe Token: SeRestorePrivilege 2212 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1372 msiexec.exe 1372 msiexec.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2212 wrote to memory of 1944 2212 msiexec.exe 32 PID 2212 wrote to memory of 1944 2212 msiexec.exe 32 PID 2212 wrote to memory of 1944 2212 msiexec.exe 32 PID 2212 wrote to memory of 1944 2212 msiexec.exe 32 PID 2212 wrote to memory of 1944 2212 msiexec.exe 32 PID 1944 wrote to memory of 2192 1944 MsiExec.exe 33 PID 1944 wrote to memory of 2192 1944 MsiExec.exe 33 PID 1944 wrote to memory of 2192 1944 MsiExec.exe 33 PID 2192 wrote to memory of 1208 2192 rundll32.exe 34 PID 2192 wrote to memory of 1208 2192 rundll32.exe 34 PID 2192 wrote to memory of 1208 2192 rundll32.exe 34 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1372
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\system32\MsiExec.exeC:\Windows\system32\MsiExec.exe -Embedding B1BA242942AAFCC95933335363B2E9812⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI78B9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259422517 1 test.old.cs!Test.CustomActions.MyAction3⤵
- Drops file in Windows directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\tmp8E7A.dll",scab4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1208
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1752
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000558" "0000000000000318"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD526761e526ae3e850a87d55dab069355a
SHA10b838460798f698420e4777e8fc0fe13d7df7d35
SHA256ceaa568a42b1c3cf3c13315baafde0aca48d273dd2cef2b47d47896b91b17e5b
SHA51215a91e4c90778308e432a0246ebdd3286edfd749dca6856c2d2714ff2ebd54191c63535ddf08ebd8616087cf9d4ae822d7f349d5806abc7d2f7367a4b8ae36a9
-
Filesize
1.6MB
MD5986c2e054d91a9466fbfadf0a5e22168
SHA1583dd35705afedf2d068f3477b481fc9654ec6b7
SHA256d51d38f49f7b810bccd6a41159e8e5142aceff1d6be775a34c2c7c54eda192d9
SHA5129106ae09b2732a2a9c8164fef5d5fc4f2c673a6fb6615a6269a286a24c0d4e3118575f05b78fdfd999540efaa2e09df5ec384b705716f059aa02d21b924286a0
-
Filesize
408KB
MD50421886125b50123188287996979264e
SHA1a7a3015012a668d35d9375a91ebc06ead1903477
SHA25663de2da6690ec48231b10585e8eeb1d320925568d55ed8de22e6cfdbb197ca2a
SHA5124cb61236b634ee1ddd44e192fbba24a47b1f6f8abefa758e7e804e5d1e3fba79396e2d65a5f8cd5dd1dc56c60415ed4d8d586a752491c056b3d6004724764eb5