Analysis
- max time kernel
146s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/04/2024, 22:07
General
- Target 847042a1dbfe2bbe81a4edd81bd710f156af4260dddd1289e6a41e9416360934.dll
- Size 894KB
- Sample240410-1114ssfh2s
- SHA256 847042a1dbfe2bbe81a4edd81bd710f156af4260dddd1289e6a41e9416360934
Malware Config
Extracted
-
latrodectus
-
https://winarkamaps.com/live/
-
https://stratimasesstr.com/live/
Signatures
- Latrodectus loader
Latrodectus is a loader written in C++.
- Detect larodectus Loader variant 2 7 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\847042a1dbfe2bbe81a4edd81bd710f156af4260dddd1289e6a41e9416360934.dll,#11⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_dcb32c2b.dll", #12⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Update_dcb32c2b.dll
memory/2140-0-0x0000000180000000-0x0000000180186000-memory.dmp
memory/2140-1-0x000001321BE90000-0x000001321BEA4000-memory.dmp
memory/2140-2-0x000001321BE60000-0x000001321BE74000-memory.dmp
memory/2140-3-0x000001321BE90000-0x000001321BEA4000-memory.dmp
memory/2140-5-0x0000000180000000-0x0000000180186000-memory.dmp
memory/2140-8-0x000001321BE90000-0x000001321BEA4000-memory.dmp
memory/4584-9-0x0000000180000000-0x0000000180186000-memory.dmp
memory/4584-12-0x0000026D87070000-0x0000026D87084000-memory.dmp
memory/4584-11-0x0000026D87050000-0x0000026D87064000-memory.dmp
memory/4584-10-0x0000026D87070000-0x0000026D87084000-memory.dmp