Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
6.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6.dll
Resource
win10v2004-20240226-en
General
-
Target
6.dll
-
Size
809KB
-
MD5
154c624507f98b908007c38fa0b73861
-
SHA1
b8986ef6ebae6b2ad37f680d25d42f2b3fab7ed4
-
SHA256
5d881d14d2336273e531b1b3d6f2d907539fe8489cbe80533280c9c72efa2273
-
SHA512
603f4c2ea46e631f3fe215d3c93da1cd1571d6efa435f819c2236fb7ca27f5331fb79e2e79716dec9edbfac3f99a3aba1ba742a9322f7069afd951864c86966c
-
SSDEEP
12288:S/cSVrVqnK0AtRTxsdzvbFbkag0UvMzK4NWJFgVgU5Sz9duW/Tw6vhWDsghGdQx/:ccS1VqinFBdQx3VcNNWMeD
Malware Config
Extracted
latrodectus
https://fluraresto.me/live/
https://mastralakkot.live/live/
Signatures
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Detect larodectus Loader variant 1 8 IoCs
resource yara_rule behavioral2/memory/4992-1-0x0000024FAA9D0000-0x0000024FAA9E1000-memory.dmp family_latrodectus_v1 behavioral2/memory/4992-0-0x0000024FAAA30000-0x0000024FAAA43000-memory.dmp family_latrodectus_v1 behavioral2/memory/4992-2-0x0000024FAAA10000-0x0000024FAAA24000-memory.dmp family_latrodectus_v1 behavioral2/memory/4992-3-0x0000024FAAA30000-0x0000024FAAA43000-memory.dmp family_latrodectus_v1 behavioral2/memory/4992-8-0x0000024FAAA30000-0x0000024FAAA43000-memory.dmp family_latrodectus_v1 behavioral2/memory/1772-9-0x000002061DF20000-0x000002061DF33000-memory.dmp family_latrodectus_v1 behavioral2/memory/1772-10-0x000002061DF20000-0x000002061DF33000-memory.dmp family_latrodectus_v1 behavioral2/memory/1772-11-0x000002061DF20000-0x000002061DF33000-memory.dmp family_latrodectus_v1 -
Deletes itself 1 IoCs
pid Process 4992 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 1772 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4992 rundll32.exe 4992 rundll32.exe 4992 rundll32.exe 4992 rundll32.exe 1772 rundll32.exe 1772 rundll32.exe 1772 rundll32.exe 1772 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4992 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4992 wrote to memory of 1772 4992 rundll32.exe 91 PID 4992 wrote to memory of 1772 4992 rundll32.exe 91 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6.dll,#11⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_36b6af86.dll", #12⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2552 --field-trial-handle=3084,i,11997299123381683778,5904351605020331957,262144 --variations-seed-version /prefetch:81⤵PID:948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
809KB
MD5154c624507f98b908007c38fa0b73861
SHA1b8986ef6ebae6b2ad37f680d25d42f2b3fab7ed4
SHA2565d881d14d2336273e531b1b3d6f2d907539fe8489cbe80533280c9c72efa2273
SHA512603f4c2ea46e631f3fe215d3c93da1cd1571d6efa435f819c2236fb7ca27f5331fb79e2e79716dec9edbfac3f99a3aba1ba742a9322f7069afd951864c86966c