Analysis
-
max time kernel
300s -
max time network
301s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 04:28
Static task
static1
Behavioral task
behavioral1
Sample
5e7b8f81ce66cfe606ea6470b596cb9fdeace6a3469ee06d3dfe049e1e2951d8.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
5e7b8f81ce66cfe606ea6470b596cb9fdeace6a3469ee06d3dfe049e1e2951d8.dll
-
Size
1.8MB
-
MD5
1cf72e954ed000c16e5cc327e91bdde4
-
SHA1
39acb9bf780d195cb9308f3f7d48d9a2e0ac6979
-
SHA256
5e7b8f81ce66cfe606ea6470b596cb9fdeace6a3469ee06d3dfe049e1e2951d8
-
SHA512
e84a447dc86fb67348cba47d48cee59088a6bbcf7086ffa91920727027e40106892769279fba27ea502e29afde48dddf971ef08418cb7a410dbc7eb2e3961fdd
-
SSDEEP
24576:7znngr4eig/HxkaoDFITvg9iLXYgIcjGNz5139EOapmIpniJ:7z64gxnoRGI9MXFrjGxNEOapmIpn
Malware Config
Extracted
latrodectus
https://arsimonopa.com/live/
https://lemonimonakio.com/live/
Signatures
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Detect larodectus Loader variant 1 2 IoCs
resource yara_rule behavioral1/memory/2408-1-0x0000000180000000-0x0000000180013000-memory.dmp family_latrodectus_v1 behavioral1/memory/4544-16-0x0000000180000000-0x0000000180013000-memory.dmp family_latrodectus_v1 -
Blocklisted process makes network request 64 IoCs
flow pid Process 62 4544 rundll32.exe 64 4544 rundll32.exe 65 4544 rundll32.exe 66 4544 rundll32.exe 67 4544 rundll32.exe 68 4544 rundll32.exe 69 4544 rundll32.exe 70 4544 rundll32.exe 71 4544 rundll32.exe 72 4544 rundll32.exe 73 4544 rundll32.exe 74 4544 rundll32.exe 75 4544 rundll32.exe 76 4544 rundll32.exe 77 4544 rundll32.exe 78 4544 rundll32.exe 79 4544 rundll32.exe 80 4544 rundll32.exe 81 4544 rundll32.exe 82 4544 rundll32.exe 83 4544 rundll32.exe 84 4544 rundll32.exe 85 4544 rundll32.exe 86 4544 rundll32.exe 87 4544 rundll32.exe 88 4544 rundll32.exe 89 4544 rundll32.exe 90 4544 rundll32.exe 91 4544 rundll32.exe 92 4544 rundll32.exe 93 4544 rundll32.exe 94 4544 rundll32.exe 95 4544 rundll32.exe 96 4544 rundll32.exe 97 4544 rundll32.exe 98 4544 rundll32.exe 99 4544 rundll32.exe 100 4544 rundll32.exe 101 4544 rundll32.exe 102 4544 rundll32.exe 103 4544 rundll32.exe 104 4544 rundll32.exe 105 4544 rundll32.exe 106 4544 rundll32.exe 107 4544 rundll32.exe 108 4544 rundll32.exe 109 4544 rundll32.exe 110 4544 rundll32.exe 111 4544 rundll32.exe 112 4544 rundll32.exe 113 4544 rundll32.exe 114 4544 rundll32.exe 115 4544 rundll32.exe 116 4544 rundll32.exe 117 4544 rundll32.exe 118 4544 rundll32.exe 119 4544 rundll32.exe 120 4544 rundll32.exe 121 4544 rundll32.exe 122 4544 rundll32.exe 123 4544 rundll32.exe 124 4544 rundll32.exe 125 4544 rundll32.exe 126 4544 rundll32.exe -
Deletes itself 1 IoCs
pid Process 2408 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 4544 rundll32.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 2408 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe 4544 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2408 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2408 wrote to memory of 4544 2408 rundll32.exe 87 PID 2408 wrote to memory of 4544 2408 rundll32.exe 87 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5e7b8f81ce66cfe606ea6470b596cb9fdeace6a3469ee06d3dfe049e1e2951d8.dll, nail1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_765773b8.dll", nail2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD51cf72e954ed000c16e5cc327e91bdde4
SHA139acb9bf780d195cb9308f3f7d48d9a2e0ac6979
SHA2565e7b8f81ce66cfe606ea6470b596cb9fdeace6a3469ee06d3dfe049e1e2951d8
SHA512e84a447dc86fb67348cba47d48cee59088a6bbcf7086ffa91920727027e40106892769279fba27ea502e29afde48dddf971ef08418cb7a410dbc7eb2e3961fdd