latrodectus | 4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a

Analysis

max time kernel
299s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

neo.msi
Size

1.5MB
MD5

37605a3eb80f3366e56938031a9ac917
SHA1

0582a0dd69d6027fb94765254ed91ad736ade305
SHA256

4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a
SHA512

772bb5538f5af14146d9bcf8d8c29a70860ecdf84b4af6cc99dae7589f60847ca7cb87b068bd2aa86f620e79d394c223b96c9fe95fe390e8a9c8422282f5b405
SSDEEP

49152:JZH3YuW8zBQSc0ZnSKmZKumZr7AQB7aLTB:7Y90Zn0K/AQwLF

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

https://jarinamaers.shop/live/

https://startmast.shop/live/

Signatures

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Detect larodectus Loader variant 2 1 IoCs

loader

resource	yara_rule
behavioral3/memory/2560-62-0x000002B483E50000-0x000002B483E64000-memory.dmp	family_latrodectus_v2

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7225.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI735E.tmp	msiexec.exe
File created	C:\Windows\Installer\e57708c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI71C6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B135729E-0574-44D1-B7A1-6E44550F506B}	msiexec.exe
File opened for modification	C:\Windows\Installer\e57708c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI70EA.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
4900	MSI735E.tmp

Loads dropped DLL 10 IoCs

pid	Process
4760	MsiExec.exe
4760	MsiExec.exe
4760	MsiExec.exe
4760	MsiExec.exe
4760	MsiExec.exe
4760	MsiExec.exe
4148	MsiExec.exe
4148	MsiExec.exe
364	rundll32.exe
2560	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000324c0cbb4829e1b20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000324c0cbb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900324c0cbb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d324c0cbb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000324c0cbb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2224	msiexec.exe
2224	msiexec.exe
4900	MSI735E.tmp
4900	MSI735E.tmp
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
364	rundll32.exe
2560	rundll32.exe
2560	rundll32.exe
2560	rundll32.exe
2560	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4568	msiexec.exe
Token: SeSecurityPrivilege	2224	msiexec.exe
Token: SeCreateTokenPrivilege	4568	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4568	msiexec.exe
Token: SeLockMemoryPrivilege	4568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4568	msiexec.exe
Token: SeMachineAccountPrivilege	4568	msiexec.exe
Token: SeTcbPrivilege	4568	msiexec.exe
Token: SeSecurityPrivilege	4568	msiexec.exe
Token: SeTakeOwnershipPrivilege	4568	msiexec.exe
Token: SeLoadDriverPrivilege	4568	msiexec.exe
Token: SeSystemProfilePrivilege	4568	msiexec.exe
Token: SeSystemtimePrivilege	4568	msiexec.exe
Token: SeProfSingleProcessPrivilege	4568	msiexec.exe
Token: SeIncBasePriorityPrivilege	4568	msiexec.exe
Token: SeCreatePagefilePrivilege	4568	msiexec.exe
Token: SeCreatePermanentPrivilege	4568	msiexec.exe
Token: SeBackupPrivilege	4568	msiexec.exe
Token: SeRestorePrivilege	4568	msiexec.exe
Token: SeShutdownPrivilege	4568	msiexec.exe
Token: SeDebugPrivilege	4568	msiexec.exe
Token: SeAuditPrivilege	4568	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4568	msiexec.exe
Token: SeChangeNotifyPrivilege	4568	msiexec.exe
Token: SeRemoteShutdownPrivilege	4568	msiexec.exe
Token: SeUndockPrivilege	4568	msiexec.exe
Token: SeSyncAgentPrivilege	4568	msiexec.exe
Token: SeEnableDelegationPrivilege	4568	msiexec.exe
Token: SeManageVolumePrivilege	4568	msiexec.exe
Token: SeImpersonatePrivilege	4568	msiexec.exe
Token: SeCreateGlobalPrivilege	4568	msiexec.exe
Token: SeCreateTokenPrivilege	4568	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4568	msiexec.exe
Token: SeLockMemoryPrivilege	4568	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4568	msiexec.exe
Token: SeMachineAccountPrivilege	4568	msiexec.exe
Token: SeTcbPrivilege	4568	msiexec.exe
Token: SeSecurityPrivilege	4568	msiexec.exe
Token: SeTakeOwnershipPrivilege	4568	msiexec.exe
Token: SeLoadDriverPrivilege	4568	msiexec.exe
Token: SeSystemProfilePrivilege	4568	msiexec.exe
Token: SeSystemtimePrivilege	4568	msiexec.exe
Token: SeProfSingleProcessPrivilege	4568	msiexec.exe
Token: SeIncBasePriorityPrivilege	4568	msiexec.exe
Token: SeCreatePagefilePrivilege	4568	msiexec.exe
Token: SeCreatePermanentPrivilege	4568	msiexec.exe
Token: SeBackupPrivilege	4568	msiexec.exe
Token: SeRestorePrivilege	4568	msiexec.exe
Token: SeShutdownPrivilege	4568	msiexec.exe
Token: SeDebugPrivilege	4568	msiexec.exe
Token: SeAuditPrivilege	4568	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4568	msiexec.exe
Token: SeChangeNotifyPrivilege	4568	msiexec.exe
Token: SeRemoteShutdownPrivilege	4568	msiexec.exe
Token: SeUndockPrivilege	4568	msiexec.exe
Token: SeSyncAgentPrivilege	4568	msiexec.exe
Token: SeEnableDelegationPrivilege	4568	msiexec.exe
Token: SeManageVolumePrivilege	4568	msiexec.exe
Token: SeImpersonatePrivilege	4568	msiexec.exe
Token: SeCreateGlobalPrivilege	4568	msiexec.exe
Token: SeCreateTokenPrivilege	4568	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4568	msiexec.exe
Token: SeLockMemoryPrivilege	4568	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4568	msiexec.exe
4568	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4760	2224	msiexec.exe	86
PID 2224 wrote to memory of 4760	2224	msiexec.exe	86
PID 2224 wrote to memory of 4760	2224	msiexec.exe	86
PID 2224 wrote to memory of 3912	2224	msiexec.exe	93
PID 2224 wrote to memory of 3912	2224	msiexec.exe	93
PID 2224 wrote to memory of 4148	2224	msiexec.exe	95
PID 2224 wrote to memory of 4148	2224	msiexec.exe	95
PID 2224 wrote to memory of 4148	2224	msiexec.exe	95
PID 2224 wrote to memory of 4900	2224	msiexec.exe	96
PID 2224 wrote to memory of 4900	2224	msiexec.exe	96
PID 2224 wrote to memory of 4900	2224	msiexec.exe	96
PID 364 wrote to memory of 2560	364	rundll32.exe	98
PID 364 wrote to memory of 2560	364	rundll32.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\neo.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4568

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6D178BE74840BACC1CA3CFE749F06D64 C
  2⤵
  - Loads dropped DLL
  PID:4760
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3912
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 579A1C3219D46F704145B1D6B4611609
  2⤵
  - Loads dropped DLL
  PID:4148
- C:\Windows\Installer\MSI735E.tmp
  "C:\Windows\Installer\MSI735E.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Local\sharepoint\360total.dll, homq
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4900

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2060

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\sharepoint\360total.dll, homq
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\System32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_9400da51.dll", homq
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57708d.rbs

Filesize
1KB

MD5
07deda7e6973cc68232e34eddee55db3

SHA1
d6f6277d2e217418de632bac06d74fc29e728e82

SHA256
0213765cf648d19f8531b54d8835c9e3bf10a96bf7c1adda566d46ba9558257b

SHA512
fd8d1902bffd41ca816ab1e96ad4e8304c775ade273235a81f0b598397285de83bf483dadcca3510bd8102e7603b3ea67ef6c5b6ac3f7e3d8a71c24a497de557

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3F4B.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Users\Admin\AppData\Local\sharepoint\360total.dll

Filesize
885KB

MD5
bd3a3714ee9a071ebeb59ac91d9ebb5a

SHA1
55110a221f20a4ceec34c58d0179fa31f8c102e9

SHA256
4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe

SHA512
7244220f29057339c99a22c20268187ba6f6681251f4ce4f305ad22dc030f6078b4f298ef10ad392dc5d036c41c7b8c28c2bd997ea39ef7ab023cb9b5c946dc8

Download Submit
C:\Windows\Installer\MSI735E.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
9ec73c26d66f9717d1af0ce31a02a660

SHA1
9b3fa10196cfd62ec1dd369e9f757e986da2eeac

SHA256
7b5da7eda0fc03833c16b3c4922b045bbeeccf998720d6465cd87e43a7081d66

SHA512
2b8a87a137ff750690a3785a7b712468753a1be50fe6000c13b6b1a3a175c8879539a983b703c1789049f8da3b6ae590d69584d02636ea7e77049f0567269526

Download Submit
\??\Volume{bb0c4c32-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d6e397e1-0469-4200-910a-9789174cd90d}_OnDiskSnapshotProp

Filesize
6KB

MD5
3a51fc734a14d3f8019c874513219bd6

SHA1
ff17344a5664dca45ba464fc333237ebed743710

SHA256
2e41d5f90a1cbb42f5b6ecd1f928757ae7a204c5dc4c254066241f377a5c710f

SHA512
7a24cc8cc536f0360e034f1712b391e173172293960121e27cc396df683fc47a7fa5296ef52128b87fe31d50aacfd7d8fbfce29e6d09a0e52cb26b43e66372ba

Download Submit
memory/364-48-0x0000000180000000-0x0000000180184000-memory.dmp

Filesize
1.5MB

Download
memory/2560-62-0x000002B483E50000-0x000002B483E64000-memory.dmp

Filesize
80KB

Download