latrodectus | 4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe | Triage

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 21:14

Sharing

Report Analysis Logs

General

Target

360total.dll
Size

885KB
MD5

bd3a3714ee9a071ebeb59ac91d9ebb5a
SHA1

55110a221f20a4ceec34c58d0179fa31f8c102e9
SHA256

4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe
SHA512

7244220f29057339c99a22c20268187ba6f6681251f4ce4f305ad22dc030f6078b4f298ef10ad392dc5d036c41c7b8c28c2bd997ea39ef7ab023cb9b5c946dc8
SSDEEP

12288:WfPSAAUHV4fZUv/TrguVTax7hNRu18VAyJFoxMk/wYeDKDMyPDi:MPSAAUHV4fZUvfgmaxpu1FyJ6xMYHMke

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

C2

https://jarinamaers.shop/live/

https://startmast.shop/live/

Signatures

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Detect larodectus Loader variant 2 2 IoCs

resource	yara_rule
behavioral1/memory/1808-0-0x00000000001C0000-0x00000000001D4000-memory.dmp	family_latrodectus_v2
behavioral1/memory/1808-1-0x00000000001C0000-0x00000000001D4000-memory.dmp	family_latrodectus_v2

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1808	rundll32.exe
1808	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\360total.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-0-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download
memory/1808-1-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download