latrodectus | 4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a

Analysis

max time kernel
299s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
26-04-2024 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

neo.msi
Size

1.5MB
MD5

37605a3eb80f3366e56938031a9ac917
SHA1

0582a0dd69d6027fb94765254ed91ad736ade305
SHA256

4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a
SHA512

772bb5538f5af14146d9bcf8d8c29a70860ecdf84b4af6cc99dae7589f60847ca7cb87b068bd2aa86f620e79d394c223b96c9fe95fe390e8a9c8422282f5b405
SSDEEP

49152:JZH3YuW8zBQSc0ZnSKmZKumZr7AQB7aLTB:7Y90Zn0K/AQwLF

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

https://jarinamaers.shop/live/

https://startmast.shop/live/

Signatures

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Detect larodectus Loader variant 2 1 IoCs

loader

resource	yara_rule
behavioral4/memory/4692-62-0x0000024C9C360000-0x0000024C9C374000-memory.dmp	family_latrodectus_v2

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e57a568.msi	msiexec.exe
File created	C:\Windows\Installer\e57a568.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF84D2AEB427C0FF2A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF23E362CD4773B450.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF321AEB0B663F8CE8.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA5B6.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B135729E-0574-44D1-B7A1-6E44550F506B}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF621BF3527C3AF2DE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA643.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA710.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
4216	MSIA710.tmp

Loads dropped DLL 11 IoCs

pid	Process
2972	MsiExec.exe
2972	MsiExec.exe
2972	MsiExec.exe
2972	MsiExec.exe
2972	MsiExec.exe
2972	MsiExec.exe
3972	MsiExec.exe
3972	MsiExec.exe
1496	rundll32.exe
4692	rundll32.exe
2736	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d35e07e9a716e6840000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d35e07e90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d35e07e9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd35e07e9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d35e07e900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
956	msiexec.exe
956	msiexec.exe
4216	MSIA710.tmp
4216	MSIA710.tmp
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
1496	rundll32.exe
4692	rundll32.exe
4692	rundll32.exe
4692	rundll32.exe
4692	rundll32.exe
2736	rundll32.exe
2736	rundll32.exe
2736	rundll32.exe
2736	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3480	msiexec.exe
Token: SeSecurityPrivilege	956	msiexec.exe
Token: SeCreateTokenPrivilege	3480	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3480	msiexec.exe
Token: SeLockMemoryPrivilege	3480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3480	msiexec.exe
Token: SeMachineAccountPrivilege	3480	msiexec.exe
Token: SeTcbPrivilege	3480	msiexec.exe
Token: SeSecurityPrivilege	3480	msiexec.exe
Token: SeTakeOwnershipPrivilege	3480	msiexec.exe
Token: SeLoadDriverPrivilege	3480	msiexec.exe
Token: SeSystemProfilePrivilege	3480	msiexec.exe
Token: SeSystemtimePrivilege	3480	msiexec.exe
Token: SeProfSingleProcessPrivilege	3480	msiexec.exe
Token: SeIncBasePriorityPrivilege	3480	msiexec.exe
Token: SeCreatePagefilePrivilege	3480	msiexec.exe
Token: SeCreatePermanentPrivilege	3480	msiexec.exe
Token: SeBackupPrivilege	3480	msiexec.exe
Token: SeRestorePrivilege	3480	msiexec.exe
Token: SeShutdownPrivilege	3480	msiexec.exe
Token: SeDebugPrivilege	3480	msiexec.exe
Token: SeAuditPrivilege	3480	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3480	msiexec.exe
Token: SeChangeNotifyPrivilege	3480	msiexec.exe
Token: SeRemoteShutdownPrivilege	3480	msiexec.exe
Token: SeUndockPrivilege	3480	msiexec.exe
Token: SeSyncAgentPrivilege	3480	msiexec.exe
Token: SeEnableDelegationPrivilege	3480	msiexec.exe
Token: SeManageVolumePrivilege	3480	msiexec.exe
Token: SeImpersonatePrivilege	3480	msiexec.exe
Token: SeCreateGlobalPrivilege	3480	msiexec.exe
Token: SeCreateTokenPrivilege	3480	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3480	msiexec.exe
Token: SeLockMemoryPrivilege	3480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3480	msiexec.exe
Token: SeMachineAccountPrivilege	3480	msiexec.exe
Token: SeTcbPrivilege	3480	msiexec.exe
Token: SeSecurityPrivilege	3480	msiexec.exe
Token: SeTakeOwnershipPrivilege	3480	msiexec.exe
Token: SeLoadDriverPrivilege	3480	msiexec.exe
Token: SeSystemProfilePrivilege	3480	msiexec.exe
Token: SeSystemtimePrivilege	3480	msiexec.exe
Token: SeProfSingleProcessPrivilege	3480	msiexec.exe
Token: SeIncBasePriorityPrivilege	3480	msiexec.exe
Token: SeCreatePagefilePrivilege	3480	msiexec.exe
Token: SeCreatePermanentPrivilege	3480	msiexec.exe
Token: SeBackupPrivilege	3480	msiexec.exe
Token: SeRestorePrivilege	3480	msiexec.exe
Token: SeShutdownPrivilege	3480	msiexec.exe
Token: SeDebugPrivilege	3480	msiexec.exe
Token: SeAuditPrivilege	3480	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3480	msiexec.exe
Token: SeChangeNotifyPrivilege	3480	msiexec.exe
Token: SeRemoteShutdownPrivilege	3480	msiexec.exe
Token: SeUndockPrivilege	3480	msiexec.exe
Token: SeSyncAgentPrivilege	3480	msiexec.exe
Token: SeEnableDelegationPrivilege	3480	msiexec.exe
Token: SeManageVolumePrivilege	3480	msiexec.exe
Token: SeImpersonatePrivilege	3480	msiexec.exe
Token: SeCreateGlobalPrivilege	3480	msiexec.exe
Token: SeCreateTokenPrivilege	3480	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3480	msiexec.exe
Token: SeLockMemoryPrivilege	3480	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3480	msiexec.exe
3480	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 2972	956	msiexec.exe	82
PID 956 wrote to memory of 2972	956	msiexec.exe	82
PID 956 wrote to memory of 2972	956	msiexec.exe	82
PID 956 wrote to memory of 1464	956	msiexec.exe	87
PID 956 wrote to memory of 1464	956	msiexec.exe	87
PID 956 wrote to memory of 3972	956	msiexec.exe	89
PID 956 wrote to memory of 3972	956	msiexec.exe	89
PID 956 wrote to memory of 3972	956	msiexec.exe	89
PID 956 wrote to memory of 4216	956	msiexec.exe	90
PID 956 wrote to memory of 4216	956	msiexec.exe	90
PID 956 wrote to memory of 4216	956	msiexec.exe	90
PID 1496 wrote to memory of 4692	1496	rundll32.exe	92
PID 1496 wrote to memory of 4692	1496	rundll32.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\neo.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3480

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F1324ABBEED7DB3B95F71A492DCA0014 C
  2⤵
  - Loads dropped DLL
  PID:2972
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1464
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F916680317F28015B8FA15CCB0EFB97B
  2⤵
  - Loads dropped DLL
  PID:3972
- C:\Windows\Installer\MSIA710.tmp
  "C:\Windows\Installer\MSIA710.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Local\sharepoint\360total.dll, homq
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4216

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1892

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\sharepoint\360total.dll, homq
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\System32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_b147e761.dll", homq
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4692

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_b147e761.dll", homq
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57a569.rbs

Filesize
1KB

MD5
07deda7e6973cc68232e34eddee55db3

SHA1
d6f6277d2e217418de632bac06d74fc29e728e82

SHA256
0213765cf648d19f8531b54d8835c9e3bf10a96bf7c1adda566d46ba9558257b

SHA512
fd8d1902bffd41ca816ab1e96ad4e8304c775ade273235a81f0b598397285de83bf483dadcca3510bd8102e7603b3ea67ef6c5b6ac3f7e3d8a71c24a497de557

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI734B.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Users\Admin\AppData\Local\sharepoint\360total.dll

Filesize
885KB

MD5
bd3a3714ee9a071ebeb59ac91d9ebb5a

SHA1
55110a221f20a4ceec34c58d0179fa31f8c102e9

SHA256
4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe

SHA512
7244220f29057339c99a22c20268187ba6f6681251f4ce4f305ad22dc030f6078b4f298ef10ad392dc5d036c41c7b8c28c2bd997ea39ef7ab023cb9b5c946dc8

Download Submit
C:\Windows\Installer\MSIA710.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.6MB

MD5
ddcba4670000f9881977789ade35e4a1

SHA1
c4520a3ef2dd8b4ac4c616d34a392ab01981bef0

SHA256
2aabb1a7cf4b6623441078dd4f41fb03d69714f68088cf5c58f1a60873cd00b4

SHA512
592d49b8a6f8b8d7796e15c92f26b614e19fc4639f59f2b117ce67e42b74117ea2f432056bfbdc1a89dfe3bf7263582a6b3fa2e502752b1a94ecd0387f3acc3b

Download Submit
\??\Volume{e9075ed3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{aa5b4682-b89f-4c41-9a58-dc01b1d28615}_OnDiskSnapshotProp

Filesize
6KB

MD5
5131dab23edaeefa4858ca36506def45

SHA1
6deb0658d5d07b4c962aca65b123a2874f949784

SHA256
34f7a7d79eb218e63bace4447ed997239689a752777c65db8c64b5d426926bb2

SHA512
b8f721a33a9dd12e5da59a5e9d1b88b325690cfdb3446da423c0434896d9206df2a625e9338e730eb6df068f23335173a58cea42d8f2d2f20cf60978ad9bd82f

Download Submit
memory/1496-48-0x0000000180000000-0x0000000180184000-memory.dmp

Filesize
1.5MB

Download
memory/4692-62-0x0000024C9C360000-0x0000024C9C374000-memory.dmp

Filesize
80KB

Download