latrodectus | 4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a

Analysis

max time kernel
67s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a.msi
Size

1.5MB
MD5

37605a3eb80f3366e56938031a9ac917
SHA1

0582a0dd69d6027fb94765254ed91ad736ade305
SHA256

4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a
SHA512

772bb5538f5af14146d9bcf8d8c29a70860ecdf84b4af6cc99dae7589f60847ca7cb87b068bd2aa86f620e79d394c223b96c9fe95fe390e8a9c8422282f5b405
SSDEEP

49152:JZH3YuW8zBQSc0ZnSKmZKumZr7AQB7aLTB:7Y90Zn0K/AQwLF

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

https://jarinamaers.shop/live/

https://startmast.shop/live/

Signatures

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Detect larodectus Loader variant 2 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4916-62-0x000001672C460000-0x000001672C474000-memory.dmp	family_latrodectus_v2

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5777ef.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5777ef.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI784D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78BB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B135729E-0574-44D1-B7A1-6E44550F506B}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7968.tmp	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
2004	MSI79F6.tmp

Loads dropped DLL 10 IoCs

pid	Process
3428	MsiExec.exe
3428	MsiExec.exe
3428	MsiExec.exe
3428	MsiExec.exe
3428	MsiExec.exe
3428	MsiExec.exe
1980	MsiExec.exe
1980	MsiExec.exe
4372	rundll32.exe
4916	rundll32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000057e87298238d7ad50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000057e872980000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090057e87298000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d57e87298000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000057e8729800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4836	msiexec.exe
4836	msiexec.exe
2004	MSI79F6.tmp
2004	MSI79F6.tmp
4372	rundll32.exe
4372	rundll32.exe
4372	rundll32.exe
4372	rundll32.exe
4916	rundll32.exe
4916	rundll32.exe
4916	rundll32.exe
4916	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3488	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3488	msiexec.exe
Token: SeSecurityPrivilege	4836	msiexec.exe
Token: SeCreateTokenPrivilege	3488	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3488	msiexec.exe
Token: SeLockMemoryPrivilege	3488	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3488	msiexec.exe
Token: SeMachineAccountPrivilege	3488	msiexec.exe
Token: SeTcbPrivilege	3488	msiexec.exe
Token: SeSecurityPrivilege	3488	msiexec.exe
Token: SeTakeOwnershipPrivilege	3488	msiexec.exe
Token: SeLoadDriverPrivilege	3488	msiexec.exe
Token: SeSystemProfilePrivilege	3488	msiexec.exe
Token: SeSystemtimePrivilege	3488	msiexec.exe
Token: SeProfSingleProcessPrivilege	3488	msiexec.exe
Token: SeIncBasePriorityPrivilege	3488	msiexec.exe
Token: SeCreatePagefilePrivilege	3488	msiexec.exe
Token: SeCreatePermanentPrivilege	3488	msiexec.exe
Token: SeBackupPrivilege	3488	msiexec.exe
Token: SeRestorePrivilege	3488	msiexec.exe
Token: SeShutdownPrivilege	3488	msiexec.exe
Token: SeDebugPrivilege	3488	msiexec.exe
Token: SeAuditPrivilege	3488	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3488	msiexec.exe
Token: SeChangeNotifyPrivilege	3488	msiexec.exe
Token: SeRemoteShutdownPrivilege	3488	msiexec.exe
Token: SeUndockPrivilege	3488	msiexec.exe
Token: SeSyncAgentPrivilege	3488	msiexec.exe
Token: SeEnableDelegationPrivilege	3488	msiexec.exe
Token: SeManageVolumePrivilege	3488	msiexec.exe
Token: SeImpersonatePrivilege	3488	msiexec.exe
Token: SeCreateGlobalPrivilege	3488	msiexec.exe
Token: SeCreateTokenPrivilege	3488	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3488	msiexec.exe
Token: SeLockMemoryPrivilege	3488	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3488	msiexec.exe
Token: SeMachineAccountPrivilege	3488	msiexec.exe
Token: SeTcbPrivilege	3488	msiexec.exe
Token: SeSecurityPrivilege	3488	msiexec.exe
Token: SeTakeOwnershipPrivilege	3488	msiexec.exe
Token: SeLoadDriverPrivilege	3488	msiexec.exe
Token: SeSystemProfilePrivilege	3488	msiexec.exe
Token: SeSystemtimePrivilege	3488	msiexec.exe
Token: SeProfSingleProcessPrivilege	3488	msiexec.exe
Token: SeIncBasePriorityPrivilege	3488	msiexec.exe
Token: SeCreatePagefilePrivilege	3488	msiexec.exe
Token: SeCreatePermanentPrivilege	3488	msiexec.exe
Token: SeBackupPrivilege	3488	msiexec.exe
Token: SeRestorePrivilege	3488	msiexec.exe
Token: SeShutdownPrivilege	3488	msiexec.exe
Token: SeDebugPrivilege	3488	msiexec.exe
Token: SeAuditPrivilege	3488	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3488	msiexec.exe
Token: SeChangeNotifyPrivilege	3488	msiexec.exe
Token: SeRemoteShutdownPrivilege	3488	msiexec.exe
Token: SeUndockPrivilege	3488	msiexec.exe
Token: SeSyncAgentPrivilege	3488	msiexec.exe
Token: SeEnableDelegationPrivilege	3488	msiexec.exe
Token: SeManageVolumePrivilege	3488	msiexec.exe
Token: SeImpersonatePrivilege	3488	msiexec.exe
Token: SeCreateGlobalPrivilege	3488	msiexec.exe
Token: SeCreateTokenPrivilege	3488	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3488	msiexec.exe
Token: SeLockMemoryPrivilege	3488	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3488	msiexec.exe
3488	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 3428	4836	msiexec.exe	85
PID 4836 wrote to memory of 3428	4836	msiexec.exe	85
PID 4836 wrote to memory of 3428	4836	msiexec.exe	85
PID 4836 wrote to memory of 524	4836	msiexec.exe	92
PID 4836 wrote to memory of 524	4836	msiexec.exe	92
PID 4836 wrote to memory of 1980	4836	msiexec.exe	94
PID 4836 wrote to memory of 1980	4836	msiexec.exe	94
PID 4836 wrote to memory of 1980	4836	msiexec.exe	94
PID 4836 wrote to memory of 2004	4836	msiexec.exe	95
PID 4836 wrote to memory of 2004	4836	msiexec.exe	95
PID 4836 wrote to memory of 2004	4836	msiexec.exe	95
PID 4372 wrote to memory of 4916	4372	rundll32.exe	97
PID 4372 wrote to memory of 4916	4372	rundll32.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4e7ac0bdb516e983b3cab7f79850d8102d2bf4117bb343b68d0da73780cceb1a.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3488

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2266DBF0120C0C58189736FE90750B64 C
  2⤵
  - Loads dropped DLL
  PID:3428
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:524
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F74D2F8AB5360ABB12893391EF48B849
  2⤵
  - Loads dropped DLL
  PID:1980
- C:\Windows\Installer\MSI79F6.tmp
  "C:\Windows\Installer\MSI79F6.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Local\sharepoint\360total.dll, homq
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1720

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\sharepoint\360total.dll, homq
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\System32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_492d308e.dll", homq
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5777f0.rbs

Filesize
1KB

MD5
1f1fa0a2d9586f7e164f53e915837396

SHA1
052029900e740a6370bcb4e59ae9a37276e84d38

SHA256
685767dbac209b27207f3968477ee7a784bccb8c2dff220d241f0eb5f95c0c47

SHA512
ac0e92aac3612d6ac492ad00d9b2b0d2b1b8c9d4a6c68700b02f93a0e9bba6e0b8df513e61e4aacc50fe080340032b46e61dc066e8938efe60f9a21f0841c78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI440E.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Users\Admin\AppData\Local\sharepoint\360total.dll

Filesize
885KB

MD5
bd3a3714ee9a071ebeb59ac91d9ebb5a

SHA1
55110a221f20a4ceec34c58d0179fa31f8c102e9

SHA256
4cf2b612939359977df51a32d2f63e2cb0c6c601e114b8e4812bd548d1db85fe

SHA512
7244220f29057339c99a22c20268187ba6f6681251f4ce4f305ad22dc030f6078b4f298ef10ad392dc5d036c41c7b8c28c2bd997ea39ef7ab023cb9b5c946dc8

Download Submit
C:\Windows\Installer\MSI79F6.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
451d2ea8778e933ac8c423abd2105bd6

SHA1
869ec746258b78430fb807b510dedc06b2205387

SHA256
737b2524d2e63aadf3e6cae8b9fcf63ce2f6a163a03bc32f4609505c942c4656

SHA512
f477b426bfe09754bdc4bf6a2514fa5ca79f8c35a06874e4bae5abe0413344514f9b19364d7378237c4a5556065f0e936dd703230e647d63dc621e1a7ae1ba27

Download Submit
\??\Volume{9872e857-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d833cbf8-ada4-47b6-af5f-a3948fc5fcf2}_OnDiskSnapshotProp

Filesize
6KB

MD5
129eb4f86f56a0b11ee9be0ce8b16902

SHA1
3d4c3f5cd3e3c71c7271434b64756352c106a1e4

SHA256
c1b5e4290eb2b7a30ffec104c2f8364980319ac3d3125dfe0117692b6c7595fc

SHA512
a3c9a57a9ee07c0705b02a199d8efa52db8829dfeceb54754e063fb85e9421cfb8da26392d527d030ef70eeb1ca2338d828c0a96b090f88a1b6e94a4f4646f59

Download Submit
memory/4372-48-0x0000000180000000-0x0000000180184000-memory.dmp

Filesize
1.5MB

Download
memory/4916-62-0x000001672C460000-0x000001672C474000-memory.dmp

Filesize
80KB

Download