Analysis
- max time kernel
140s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
26/04/2024, 01:02
General
- Target 1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11.dll
- Size 885KB
- Sample240426-bd2z5sgf2y
- SHA256 1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11
Score
10/10
Malware Config
Extracted
Family
-
latrodectus
C2
-
https://jarinamaers.shop/live/
-
https://wrankaget.site/live/
Signatures
- Latrodectus loader
Latrodectus is a loader written in C++.
- Detect larodectus Loader variant 2 6 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1625ac230aa5ca950573f3ba0b1a7bd4c7fbd3e3686f9ecd4a40f1504bf33a11.dll,#11⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_4b6bd7b5.dll", #12⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_4b6bd7b5.dll", #11⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Update_4b6bd7b5.dll
memory/2108-0-0x000002733EA70000-0x000002733EA84000-memory.dmp
memory/2108-2-0x0000000180000000-0x0000000180184000-memory.dmp
memory/2108-5-0x000002733EA70000-0x000002733EA84000-memory.dmp
memory/3012-9-0x000002115E300000-0x000002115E314000-memory.dmp
memory/3012-10-0x000002115E300000-0x000002115E314000-memory.dmp
memory/3972-6-0x000002DC5C5A0000-0x000002DC5C5B4000-memory.dmp
memory/3972-7-0x000002DC5C5A0000-0x000002DC5C5B4000-memory.dmp