Analysis
- max time kernel
67s - max time network
50s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
27/04/2024, 01:22
Static task
static1
Behavioral task
behavioral1
Sample
4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a.msi
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a.msi
Resource
win10v2004-20240419-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a.msi
- Size 1.5MB
- Sample240427-brhtesgh7y
- SHA256 4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a
- MD5 37605a3eb80f3366e56938031a9ac917
- SHA1 0582a0dd69d6027fb94765254ed91ad736ade305
- SHA512 772bb5538f5af14146d9bcf8d8c29a70860ecdf84b4af6cc99dae7589f60847ca7cb87b068bd2aa86f620e79d394c223b96c9fe95fe390e8a9c8422282f5b405
- SSDEEP 49152:JZH3YuW8zBQSc0ZnSKmZKumZr7AQB7aLTB:7Y90Zn0K/AQwLF
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
latrodectus
C2
-
https://jarinamaers.shop/live/
-
https://startmast.shop/live/
Signatures
- Latrodectus loader
Latrodectus is a loader written in C++.
- Detect larodectus Loader variant 2 1 IoCs
resource yara_rule behavioral2/memory/4916-62-0x000001672C460000-0x000001672C474000-memory.dmp family_latrodectus_v2 - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\Installer\e5777ef.msi msiexec.exe File opened for modification C:\Windows\Installer\e5777ef.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI79F6.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI784D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI78BB.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{B135729E-0574-44D1-B7A1-6E44550F506B} msiexec.exe File opened for modification C:\Windows\Installer\MSI7968.tmp msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 2004 MSI79F6.tmp - Loads dropped DLL 10 IoCs
pid Process 3428 MsiExec.exe 3428 MsiExec.exe 3428 MsiExec.exe 3428 MsiExec.exe 3428 MsiExec.exe 3428 MsiExec.exe 1980 MsiExec.exe 1980 MsiExec.exe 4372 rundll32.exe 4916 rundll32.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000057e87298238d7ad50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000057e872980000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090057e87298000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d57e87298000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000057e8729800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4836 msiexec.exe 4836 msiexec.exe 2004 MSI79F6.tmp 2004 MSI79F6.tmp 4372 rundll32.exe 4372 rundll32.exe 4372 rundll32.exe 4372 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe 4916 rundll32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3488 msiexec.exe Token: SeIncreaseQuotaPrivilege 3488 msiexec.exe Token: SeSecurityPrivilege 4836 msiexec.exe Token: SeCreateTokenPrivilege 3488 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3488 msiexec.exe Token: SeLockMemoryPrivilege 3488 msiexec.exe Token: SeIncreaseQuotaPrivilege 3488 msiexec.exe Token: SeMachineAccountPrivilege 3488 msiexec.exe Token: SeTcbPrivilege 3488 msiexec.exe Token: SeSecurityPrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeLoadDriverPrivilege 3488 msiexec.exe Token: SeSystemProfilePrivilege 3488 msiexec.exe Token: SeSystemtimePrivilege 3488 msiexec.exe Token: SeProfSingleProcessPrivilege 3488 msiexec.exe Token: SeIncBasePriorityPrivilege 3488 msiexec.exe Token: SeCreatePagefilePrivilege 3488 msiexec.exe Token: SeCreatePermanentPrivilege 3488 msiexec.exe Token: SeBackupPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeShutdownPrivilege 3488 msiexec.exe Token: SeDebugPrivilege 3488 msiexec.exe Token: SeAuditPrivilege 3488 msiexec.exe Token: SeSystemEnvironmentPrivilege 3488 msiexec.exe Token: SeChangeNotifyPrivilege 3488 msiexec.exe Token: SeRemoteShutdownPrivilege 3488 msiexec.exe Token: SeUndockPrivilege 3488 msiexec.exe Token: SeSyncAgentPrivilege 3488 msiexec.exe Token: SeEnableDelegationPrivilege 3488 msiexec.exe Token: SeManageVolumePrivilege 3488 msiexec.exe Token: SeImpersonatePrivilege 3488 msiexec.exe Token: SeCreateGlobalPrivilege 3488 msiexec.exe Token: SeCreateTokenPrivilege 3488 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3488 msiexec.exe Token: SeLockMemoryPrivilege 3488 msiexec.exe Token: SeIncreaseQuotaPrivilege 3488 msiexec.exe Token: SeMachineAccountPrivilege 3488 msiexec.exe Token: SeTcbPrivilege 3488 msiexec.exe Token: SeSecurityPrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeLoadDriverPrivilege 3488 msiexec.exe Token: SeSystemProfilePrivilege 3488 msiexec.exe Token: SeSystemtimePrivilege 3488 msiexec.exe Token: SeProfSingleProcessPrivilege 3488 msiexec.exe Token: SeIncBasePriorityPrivilege 3488 msiexec.exe Token: SeCreatePagefilePrivilege 3488 msiexec.exe Token: SeCreatePermanentPrivilege 3488 msiexec.exe Token: SeBackupPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeShutdownPrivilege 3488 msiexec.exe Token: SeDebugPrivilege 3488 msiexec.exe Token: SeAuditPrivilege 3488 msiexec.exe Token: SeSystemEnvironmentPrivilege 3488 msiexec.exe Token: SeChangeNotifyPrivilege 3488 msiexec.exe Token: SeRemoteShutdownPrivilege 3488 msiexec.exe Token: SeUndockPrivilege 3488 msiexec.exe Token: SeSyncAgentPrivilege 3488 msiexec.exe Token: SeEnableDelegationPrivilege 3488 msiexec.exe Token: SeManageVolumePrivilege 3488 msiexec.exe Token: SeImpersonatePrivilege 3488 msiexec.exe Token: SeCreateGlobalPrivilege 3488 msiexec.exe Token: SeCreateTokenPrivilege 3488 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3488 msiexec.exe Token: SeLockMemoryPrivilege 3488 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3488 msiexec.exe 3488 msiexec.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4836 wrote to memory of 3428 4836 msiexec.exe 85 PID 4836 wrote to memory of 3428 4836 msiexec.exe 85 PID 4836 wrote to memory of 3428 4836 msiexec.exe 85 PID 4836 wrote to memory of 524 4836 msiexec.exe 92 PID 4836 wrote to memory of 524 4836 msiexec.exe 92 PID 4836 wrote to memory of 1980 4836 msiexec.exe 94 PID 4836 wrote to memory of 1980 4836 msiexec.exe 94 PID 4836 wrote to memory of 1980 4836 msiexec.exe 94 PID 4836 wrote to memory of 2004 4836 msiexec.exe 95 PID 4836 wrote to memory of 2004 4836 msiexec.exe 95 PID 4836 wrote to memory of 2004 4836 msiexec.exe 95 PID 4372 wrote to memory of 4916 4372 rundll32.exe 97 PID 4372 wrote to memory of 4916 4372 rundll32.exe 97 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3488
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2266DBF0120C0C58189736FE90750B64 C2⤵
- Loads dropped DLL
PID:3428
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:524
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F74D2F8AB5360ABB12893391EF48B8492⤵
- Loads dropped DLL
PID:1980
-
-
C:\Windows\Installer\MSI79F6.tmp"C:\Windows\Installer\MSI79F6.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Local\sharepoint\360total.dll, homq2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2004
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1720
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\sharepoint\360total.dll, homq1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\System32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_492d308e.dll", homq2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5777f0.rbs
- Size 1KB
- SHA256 685767dbac209b27207f3968477ee7a784bccb8c2dff220d241f0eb5f95c0c47
- MD5 1f1fa0a2d9586f7e164f53e915837396
- SHA1 052029900e740a6370bcb4e59ae9a37276e84d38
- SHA512 ac0e92aac3612d6ac492ad00d9b2b0d2b1b8c9d4a6c68700b02f93a0e9bba6e0b8df513e61e4aacc50fe080340032b46e61dc066e8938efe60f9a21f0841c78c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSI440E.tmp
- Size 436KB
- SHA256 426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
- MD5 475d20c0ea477a35660e3f67ecf0a1df
- SHA1 67340739f51e1134ae8f0ffc5ae9dd710e8e3a08
- SHA512 99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
- SSDEEP 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\sharepoint\360total.dll
- Size 885KB
- SHA256 4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe
- MD5 bd3a3714ee9a071ebeb59ac91d9ebb5a
- SHA1 55110a221f20a4ceec34c58d0179fa31f8c102e9
- SHA512 7244220f29057339c99a22c20268187ba6f6681251f4ce4f305ad22dc030f6078b4f298ef10ad392dc5d036c41c7b8c28c2bd997ea39ef7ab023cb9b5c946dc8
- SSDEEP 12288:WfPSAAUHV4fZUv/TrguVTax7hNRu18VAyJFoxMk/wYeDKDMyPDi:MPSAAUHV4fZUvfgmaxpu1FyJ6xMYHMke
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI79F6.tmp
- Size 389KB
- SHA256 1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
- MD5 b9545ed17695a32face8c3408a6a3553
- SHA1 f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
- SHA512 f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
- SSDEEP 6144:gMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1:gMvZx0FlS68zBQSncb4ZPQTpAjZxqO1
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 737b2524d2e63aadf3e6cae8b9fcf63ce2f6a163a03bc32f4609505c942c4656
- MD5 451d2ea8778e933ac8c423abd2105bd6
- SHA1 869ec746258b78430fb807b510dedc06b2205387
- SHA512 f477b426bfe09754bdc4bf6a2514fa5ca79f8c35a06874e4bae5abe0413344514f9b19364d7378237c4a5556065f0e936dd703230e647d63dc621e1a7ae1ba27
- SSDEEP 24576:1Zxm+1d8doO/vvTLNWu+LmKKfHdxWFjSyIm9ch/1206/O5npYPl9mYlB7N:m2
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{9872e857-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d833cbf8-ada4-47b6-af5f-a3948fc5fcf2}_OnDiskSnapshotProp
- Size 6KB
- SHA256 c1b5e4290eb2b7a30ffec104c2f8364980319ac3d3125dfe0117692b6c7595fc
- MD5 129eb4f86f56a0b11ee9be0ce8b16902
- SHA1 3d4c3f5cd3e3c71c7271434b64756352c106a1e4
- SHA512 a3c9a57a9ee07c0705b02a199d8efa52db8829dfeceb54754e063fb85e9421cfb8da26392d527d030ef70eeb1ca2338d828c0a96b090f88a1b6e94a4f4646f59
- SSDEEP 96:FBzGxNW4xDD84LTHzbOHXOHBlBRQs8Sc9XE56tOSVQpu:3zcb++lVm
- MD5 SHA1 SHA512 SSDEEP