latrodectus | 4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a

Analysis

max time kernel
56s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

neo.msi
Size

1.5MB
MD5

37605a3eb80f3366e56938031a9ac917
SHA1

0582a0dd69d6027fb94765254ed91ad736ade305
SHA256

4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a
SHA512

772bb5538f5af14146d9bcf8d8c29a70860ecdf84b4af6cc99dae7589f60847ca7cb87b068bd2aa86f620e79d394c223b96c9fe95fe390e8a9c8422282f5b405
SSDEEP

49152:JZH3YuW8zBQSc0ZnSKmZKumZr7AQB7aLTB:7Y90Zn0K/AQwLF

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

https://jarinamaers.shop/live/

https://startmast.shop/live/

Signatures

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Detect larodectus Loader variant 2 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3812-62-0x0000016FCB300000-0x0000016FCB314000-memory.dmp	family_latrodectus_v2

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7AA0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e577947.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7995.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A13.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B135729E-0574-44D1-B7A1-6E44550F506B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7AFF.tmp	msiexec.exe
File created	C:\Windows\Installer\e577947.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
4872	MSI7AFF.tmp

Loads dropped DLL 10 IoCs

pid	Process
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
1680	MsiExec.exe
2212	MsiExec.exe
2212	MsiExec.exe
4892	rundll32.exe
3812	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000828eb54ef8e6371f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000828eb54e0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900828eb54e000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d828eb54e000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000828eb54e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2928	msiexec.exe
2928	msiexec.exe
4872	MSI7AFF.tmp
4872	MSI7AFF.tmp
4892	rundll32.exe
4892	rundll32.exe
4892	rundll32.exe
4892	rundll32.exe
3812	rundll32.exe
3812	rundll32.exe
3812	rundll32.exe
3812	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1984	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1984	msiexec.exe
Token: SeSecurityPrivilege	2928	msiexec.exe
Token: SeCreateTokenPrivilege	1984	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1984	msiexec.exe
Token: SeLockMemoryPrivilege	1984	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1984	msiexec.exe
Token: SeMachineAccountPrivilege	1984	msiexec.exe
Token: SeTcbPrivilege	1984	msiexec.exe
Token: SeSecurityPrivilege	1984	msiexec.exe
Token: SeTakeOwnershipPrivilege	1984	msiexec.exe
Token: SeLoadDriverPrivilege	1984	msiexec.exe
Token: SeSystemProfilePrivilege	1984	msiexec.exe
Token: SeSystemtimePrivilege	1984	msiexec.exe
Token: SeProfSingleProcessPrivilege	1984	msiexec.exe
Token: SeIncBasePriorityPrivilege	1984	msiexec.exe
Token: SeCreatePagefilePrivilege	1984	msiexec.exe
Token: SeCreatePermanentPrivilege	1984	msiexec.exe
Token: SeBackupPrivilege	1984	msiexec.exe
Token: SeRestorePrivilege	1984	msiexec.exe
Token: SeShutdownPrivilege	1984	msiexec.exe
Token: SeDebugPrivilege	1984	msiexec.exe
Token: SeAuditPrivilege	1984	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1984	msiexec.exe
Token: SeChangeNotifyPrivilege	1984	msiexec.exe
Token: SeRemoteShutdownPrivilege	1984	msiexec.exe
Token: SeUndockPrivilege	1984	msiexec.exe
Token: SeSyncAgentPrivilege	1984	msiexec.exe
Token: SeEnableDelegationPrivilege	1984	msiexec.exe
Token: SeManageVolumePrivilege	1984	msiexec.exe
Token: SeImpersonatePrivilege	1984	msiexec.exe
Token: SeCreateGlobalPrivilege	1984	msiexec.exe
Token: SeCreateTokenPrivilege	1984	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1984	msiexec.exe
Token: SeLockMemoryPrivilege	1984	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1984	msiexec.exe
Token: SeMachineAccountPrivilege	1984	msiexec.exe
Token: SeTcbPrivilege	1984	msiexec.exe
Token: SeSecurityPrivilege	1984	msiexec.exe
Token: SeTakeOwnershipPrivilege	1984	msiexec.exe
Token: SeLoadDriverPrivilege	1984	msiexec.exe
Token: SeSystemProfilePrivilege	1984	msiexec.exe
Token: SeSystemtimePrivilege	1984	msiexec.exe
Token: SeProfSingleProcessPrivilege	1984	msiexec.exe
Token: SeIncBasePriorityPrivilege	1984	msiexec.exe
Token: SeCreatePagefilePrivilege	1984	msiexec.exe
Token: SeCreatePermanentPrivilege	1984	msiexec.exe
Token: SeBackupPrivilege	1984	msiexec.exe
Token: SeRestorePrivilege	1984	msiexec.exe
Token: SeShutdownPrivilege	1984	msiexec.exe
Token: SeDebugPrivilege	1984	msiexec.exe
Token: SeAuditPrivilege	1984	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1984	msiexec.exe
Token: SeChangeNotifyPrivilege	1984	msiexec.exe
Token: SeRemoteShutdownPrivilege	1984	msiexec.exe
Token: SeUndockPrivilege	1984	msiexec.exe
Token: SeSyncAgentPrivilege	1984	msiexec.exe
Token: SeEnableDelegationPrivilege	1984	msiexec.exe
Token: SeManageVolumePrivilege	1984	msiexec.exe
Token: SeImpersonatePrivilege	1984	msiexec.exe
Token: SeCreateGlobalPrivilege	1984	msiexec.exe
Token: SeCreateTokenPrivilege	1984	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1984	msiexec.exe
Token: SeLockMemoryPrivilege	1984	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1984	msiexec.exe
1984	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1680	2928	msiexec.exe	86
PID 2928 wrote to memory of 1680	2928	msiexec.exe	86
PID 2928 wrote to memory of 1680	2928	msiexec.exe	86
PID 2928 wrote to memory of 1224	2928	msiexec.exe	93
PID 2928 wrote to memory of 1224	2928	msiexec.exe	93
PID 2928 wrote to memory of 2212	2928	msiexec.exe	95
PID 2928 wrote to memory of 2212	2928	msiexec.exe	95
PID 2928 wrote to memory of 2212	2928	msiexec.exe	95
PID 2928 wrote to memory of 4872	2928	msiexec.exe	96
PID 2928 wrote to memory of 4872	2928	msiexec.exe	96
PID 2928 wrote to memory of 4872	2928	msiexec.exe	96
PID 4892 wrote to memory of 3812	4892	rundll32.exe	98
PID 4892 wrote to memory of 3812	4892	rundll32.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\neo.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1984

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FE002BE18ABC048BCB8D5EF82073714D C
  2⤵
  - Loads dropped DLL
  PID:1680
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1224
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 127EE3D9E8E284BBC0B66F9824508981
  2⤵
  - Loads dropped DLL
  PID:2212
- C:\Windows\Installer\MSI7AFF.tmp
  "C:\Windows\Installer\MSI7AFF.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Local\sharepoint\360total.dll, homq
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2416

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\sharepoint\360total.dll, homq
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\System32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_a14cd700.dll", homq
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e577948.rbs

Filesize
1KB

MD5
7f9a6c5e99125fec845a0e3a384eecf3

SHA1
2d6ad3fcdf6471a09cdf708200ffa28d2f23d92c

SHA256
ea8209de5d2e8829baa2bd75722e4b3135e114db00efc7aa3eea2fb15bc9f101

SHA512
d6f6cd76379d823a0125f65d78bce85f370e84a6e5a51c0318d820dadee3dc41144be2967b8866910f1007cf00268e5617f61a4c2bd1557820bac8a26c124a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3E8F.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Users\Admin\AppData\Local\sharepoint\360total.dll

Filesize
885KB

MD5
bd3a3714ee9a071ebeb59ac91d9ebb5a

SHA1
55110a221f20a4ceec34c58d0179fa31f8c102e9

SHA256
4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe

SHA512
7244220f29057339c99a22c20268187ba6f6681251f4ce4f305ad22dc030f6078b4f298ef10ad392dc5d036c41c7b8c28c2bd997ea39ef7ab023cb9b5c946dc8

Download Submit
C:\Windows\Installer\MSI7AFF.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
ec4a74bd87af0f03b5a1230acb3f3a8f

SHA1
587307aa977fca6d05050b8c0006353c13c39bd7

SHA256
4afaf81e404d6b0e51e7cfc4b18fc6f5acb5cd36862a6f07b056a137309448e4

SHA512
15da442b7f9f8e0d3c1cb4581a4d8ce36ea1fb8fe3378703fd03c9d6d9892a602c7ec0da108c5f5d93d83cdc03550d3ded2d40c55149589e31a4c31edf291e65

Download Submit
\??\Volume{4eb58e82-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1bfa50c2-0452-4475-9e9d-69ed70285e58}_OnDiskSnapshotProp

Filesize
6KB

MD5
60fab6675124866a677f36a82c8fd726

SHA1
2dcfb14c1ac243f7a4db0a75d587aabf1d37f98a

SHA256
a191765f815a06e45b942aa3a80723bc38716b3b3d01b7e8e8619b46d48ac642

SHA512
baaafd156272704b4be716340a4765887faa86bc5e9a25b11e3003a5b4bcda02672c60bb507b444399841b79093c77c732d1fd587db2ee415a08d5bf8cb352fe

Download Submit
memory/3812-62-0x0000016FCB300000-0x0000016FCB314000-memory.dmp

Filesize
80KB

Download
memory/4892-48-0x0000000180000000-0x0000000180184000-memory.dmp

Filesize
1.5MB

Download