latrodectus | 0f0757d1baa3bd0341d282bb0afcdbdb522676db05814a3c3051c08829151b52

Resubmissions

02-04-2024 20:58

240402-zr8lvadd93 10

01-04-2024 22:38

240401-2ksyxshf68 10

01-04-2024 22:32

240401-2f8tksha31 10

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2024 20:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib.msi
Size

1.5MB
MD5

e1692df23c8753b5744c77570aca2f2e
SHA1

71a71557601602427c80021acb978cccb78e1536
SHA256

0f0757d1baa3bd0341d282bb0afcdbdb522676db05814a3c3051c08829151b52
SHA512

4ce5eba6204ff771fa65e102529580c67076aa7906d38f240c3caf49e4ba35633384015db2ac63c4b29f340152bc6720fcec4d7e42dfdab8c21c4c6659ee5504
SSDEEP

24576:SwRxLNvYLSMvZCFlp8zBQSc0ZoCvqKwx0ECIgYmfLVYeBZr7AuSqTicJ2I0x:SwxvYpW8zBQSc0ZnSKeZKumZr7AjqAI0

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

https://titnovacrion.top/live/

https://skinnyjeanso.com/live/

Signatures

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Detect larodectus Loader variant 2 8 IoCs

loader

resource	yara_rule
behavioral2/memory/828-48-0x0000021AB6B70000-0x0000021AB6B84000-memory.dmp	family_latrodectus_v2
behavioral2/memory/828-49-0x0000021AB6B50000-0x0000021AB6B64000-memory.dmp	family_latrodectus_v2
behavioral2/memory/828-50-0x0000021AB6B70000-0x0000021AB6B84000-memory.dmp	family_latrodectus_v2
behavioral2/memory/828-55-0x0000021AB6B70000-0x0000021AB6B84000-memory.dmp	family_latrodectus_v2
behavioral2/memory/2484-68-0x000002261EFE0000-0x000002261EFF4000-memory.dmp	family_latrodectus_v2
behavioral2/memory/2484-69-0x000002261EFC0000-0x000002261EFD4000-memory.dmp	family_latrodectus_v2
behavioral2/memory/2484-70-0x000002261EFE0000-0x000002261EFF4000-memory.dmp	family_latrodectus_v2
behavioral2/memory/2484-71-0x000002261EFE0000-0x000002261EFF4000-memory.dmp	family_latrodectus_v2

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57fb29.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFB96.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFC62.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD6D.tmp	msiexec.exe
File created	C:\Windows\Installer\e57fb29.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9AC22351-D2AA-4C6B-8AA9-A2E8BE2FF4E0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDEB.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
3064	MSIFDEB.tmp

Loads dropped DLL 10 IoCs

pid	Process
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
2764	MsiExec.exe
4488	MsiExec.exe
4488	MsiExec.exe
828	rundll32.exe
2484	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003820acb1425541bc0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003820acb10000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003820acb1000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3820acb1000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003820acb100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1996	msiexec.exe
1996	msiexec.exe
3064	MSIFDEB.tmp
3064	MSIFDEB.tmp
828	rundll32.exe
828	rundll32.exe
828	rundll32.exe
828	rundll32.exe
2484	rundll32.exe
2484	rundll32.exe
2484	rundll32.exe
2484	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3140	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3140	msiexec.exe
Token: SeSecurityPrivilege	1996	msiexec.exe
Token: SeCreateTokenPrivilege	3140	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3140	msiexec.exe
Token: SeLockMemoryPrivilege	3140	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3140	msiexec.exe
Token: SeMachineAccountPrivilege	3140	msiexec.exe
Token: SeTcbPrivilege	3140	msiexec.exe
Token: SeSecurityPrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeLoadDriverPrivilege	3140	msiexec.exe
Token: SeSystemProfilePrivilege	3140	msiexec.exe
Token: SeSystemtimePrivilege	3140	msiexec.exe
Token: SeProfSingleProcessPrivilege	3140	msiexec.exe
Token: SeIncBasePriorityPrivilege	3140	msiexec.exe
Token: SeCreatePagefilePrivilege	3140	msiexec.exe
Token: SeCreatePermanentPrivilege	3140	msiexec.exe
Token: SeBackupPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeShutdownPrivilege	3140	msiexec.exe
Token: SeDebugPrivilege	3140	msiexec.exe
Token: SeAuditPrivilege	3140	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3140	msiexec.exe
Token: SeChangeNotifyPrivilege	3140	msiexec.exe
Token: SeRemoteShutdownPrivilege	3140	msiexec.exe
Token: SeUndockPrivilege	3140	msiexec.exe
Token: SeSyncAgentPrivilege	3140	msiexec.exe
Token: SeEnableDelegationPrivilege	3140	msiexec.exe
Token: SeManageVolumePrivilege	3140	msiexec.exe
Token: SeImpersonatePrivilege	3140	msiexec.exe
Token: SeCreateGlobalPrivilege	3140	msiexec.exe
Token: SeCreateTokenPrivilege	3140	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3140	msiexec.exe
Token: SeLockMemoryPrivilege	3140	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3140	msiexec.exe
Token: SeMachineAccountPrivilege	3140	msiexec.exe
Token: SeTcbPrivilege	3140	msiexec.exe
Token: SeSecurityPrivilege	3140	msiexec.exe
Token: SeTakeOwnershipPrivilege	3140	msiexec.exe
Token: SeLoadDriverPrivilege	3140	msiexec.exe
Token: SeSystemProfilePrivilege	3140	msiexec.exe
Token: SeSystemtimePrivilege	3140	msiexec.exe
Token: SeProfSingleProcessPrivilege	3140	msiexec.exe
Token: SeIncBasePriorityPrivilege	3140	msiexec.exe
Token: SeCreatePagefilePrivilege	3140	msiexec.exe
Token: SeCreatePermanentPrivilege	3140	msiexec.exe
Token: SeBackupPrivilege	3140	msiexec.exe
Token: SeRestorePrivilege	3140	msiexec.exe
Token: SeShutdownPrivilege	3140	msiexec.exe
Token: SeDebugPrivilege	3140	msiexec.exe
Token: SeAuditPrivilege	3140	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3140	msiexec.exe
Token: SeChangeNotifyPrivilege	3140	msiexec.exe
Token: SeRemoteShutdownPrivilege	3140	msiexec.exe
Token: SeUndockPrivilege	3140	msiexec.exe
Token: SeSyncAgentPrivilege	3140	msiexec.exe
Token: SeEnableDelegationPrivilege	3140	msiexec.exe
Token: SeManageVolumePrivilege	3140	msiexec.exe
Token: SeImpersonatePrivilege	3140	msiexec.exe
Token: SeCreateGlobalPrivilege	3140	msiexec.exe
Token: SeCreateTokenPrivilege	3140	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3140	msiexec.exe
Token: SeLockMemoryPrivilege	3140	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3140	msiexec.exe
3140	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2764	1996	msiexec.exe	95
PID 1996 wrote to memory of 2764	1996	msiexec.exe	95
PID 1996 wrote to memory of 2764	1996	msiexec.exe	95
PID 1996 wrote to memory of 4624	1996	msiexec.exe	112
PID 1996 wrote to memory of 4624	1996	msiexec.exe	112
PID 1996 wrote to memory of 4488	1996	msiexec.exe	114
PID 1996 wrote to memory of 4488	1996	msiexec.exe	114
PID 1996 wrote to memory of 4488	1996	msiexec.exe	114
PID 1996 wrote to memory of 3064	1996	msiexec.exe	115
PID 1996 wrote to memory of 3064	1996	msiexec.exe	115
PID 1996 wrote to memory of 3064	1996	msiexec.exe	115
PID 828 wrote to memory of 2484	828	rundll32.exe	117
PID 828 wrote to memory of 2484	828	rundll32.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\lib.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3140

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C13C7A8B1BCC03694F03A6BC0A645E4D C
  2⤵
  - Loads dropped DLL
  PID:2764
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4624
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2788A2E379FD4F79F4B9CCFDE52C159B
  2⤵
  - Loads dropped DLL
  PID:4488
- C:\Windows\Installer\MSIFDEB.tmp
  "C:\Windows\Installer\MSIFDEB.tmp" C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\libroffice\rsa.dll, home
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2840

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\libroffice\rsa.dll, home
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\System32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_532752bf.dll", home
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3380 --field-trial-handle=2148,i,1752153415760610784,11376271161549019716,262144 --variations-seed-version /prefetch:8
1⤵
PID:5432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57fb2a.rbs

Filesize
1KB

MD5
730f171b55a1bbe6a4bae5fbd7567547

SHA1
a6e705afb6da1162e1c0831d0769e79e98ba5f69

SHA256
c4b618740d61bd6d14f22a09b55e0375cd17314ab36acda2a68b77b008cb52fb

SHA512
4a048ad8de0377bd892d57cfa2293293c8ab75b9578fb3ab1be49a134870474a39a94e71d80ddd9e04244690cd95c112452ac94b4ba02d6b15fae16629628b4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8388.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Users\Admin\AppData\Local\libroffice\rsa.dll

Filesize
740KB

MD5
3925637dae8797721f30976e688b84d8

SHA1
e260fc3f8646b605cf05684afca681dc74061efa

SHA256
17ddc339b14845bc9d67c5c3cd9a0e617387cc0569131ff3641035d82043effa

SHA512
7ae16443b752c88a7e9231120cc337bf4c7d05b67daa572771d0daed49e4ee7efec3ec4a64faf8799f69d01b6928d82d9d284d8ccc1410595dafd531fd17e880

Download Submit
C:\Windows\Installer\MSIFDEB.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
f94cd2c5bbbfc09642baf3b252837742

SHA1
08fb0bd8a93d70a31459ad8ec94d439effd1d72b

SHA256
747bf473ecf5cc465348192b1b42e6201181bd0a2815b8c65c81e7e63d9446e1

SHA512
be7cfffdfa7bd4dfc1c4acb19b5460755d6355b14816df5aee063e3734e5ebde9a4a574f1a73bcc9631eb3ab447f30a3b89c68671800e325e80837179c70f5e4

Download Submit
\??\Volume{b1ac2038-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6b89bf05-3037-4838-a9be-d31087ca8a0d}_OnDiskSnapshotProp

Filesize
6KB

MD5
f2f45c4b3a577f7382aa75cc385ee530

SHA1
101066e499e9280d6c942c325f72344a06a6cb83

SHA256
467e5c59f7f652eb13d5773d37eae634477c39599628a48a9af1452fb11afd72

SHA512
1a996c224e08ce1d1620b4354fb88ba34f00ed837d2710f22f480681e0173811fe8145138ef46b379b8db2477f668cc08e7aa8519544ef67755282dd3cbb4a62

Download Submit
memory/828-47-0x0000000180000000-0x00000001800BF000-memory.dmp

Filesize
764KB

Download
memory/828-48-0x0000021AB6B70000-0x0000021AB6B84000-memory.dmp

Filesize
80KB

Download
memory/828-49-0x0000021AB6B50000-0x0000021AB6B64000-memory.dmp

Filesize
80KB

Download
memory/828-50-0x0000021AB6B70000-0x0000021AB6B84000-memory.dmp

Filesize
80KB

Download
memory/828-55-0x0000021AB6B70000-0x0000021AB6B84000-memory.dmp

Filesize
80KB

Download
memory/828-52-0x0000000180000000-0x00000001800BF000-memory.dmp

Filesize
764KB

Download
memory/2484-56-0x0000000180000000-0x00000001800BF000-memory.dmp

Filesize
764KB

Download
memory/2484-70-0x000002261EFE0000-0x000002261EFF4000-memory.dmp

Filesize
80KB

Download
memory/2484-71-0x000002261EFE0000-0x000002261EFF4000-memory.dmp

Filesize
80KB

Download
memory/2484-69-0x000002261EFC0000-0x000002261EFD4000-memory.dmp

Filesize
80KB

Download
memory/2484-68-0x000002261EFE0000-0x000002261EFF4000-memory.dmp

Filesize
80KB

Download