Analysis

  • max time kernel
    122s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-04-2024 00:38

General

  • Target

    https://deadvogados.com/wp-content/plugins/share-private-fls/shared

Score
10/10

Malware Config

Extracted

Family

latrodectus

C2

https://jarinamaers.shop/live/

https://startmast.shop/live/

Signatures

  • Latrodectus loader

    Latrodectus is a loader written in C++.

  • Detect larodectus Loader variant 2 1 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 10 IoCs
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://deadvogados.com/wp-content/plugins/share-private-fls/shared"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://deadvogados.com/wp-content/plugins/share-private-fls/shared
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2532
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2028 -parentBuildID 20240401114208 -prefsHandle 1956 -prefMapHandle 1948 -prefsLen 25457 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa73a24c-ead2-4968-bde7-248a574958f0} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" gpu
        3⤵
          PID:4340
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2440 -prefsLen 26377 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea53ab8f-cb0f-45db-a95b-c21059712f26} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" socket
          3⤵
            PID:1440
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2756 -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 3200 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef1fcaa8-5b7c-425a-9763-250504607918} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
            3⤵
              PID:3152
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2828 -childID 2 -isForBrowser -prefsHandle 3752 -prefMapHandle 2740 -prefsLen 30867 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0c951950-d794-4255-92c0-cbaa3b64cc3d} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
              3⤵
                PID:4628
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4488 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4444 -prefMapHandle 4408 -prefsLen 30867 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {843dd9db-2a19-4c0e-a2c3-418dc4d2c9a3} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" utility
                3⤵
                • Checks processor information in registry
                PID:4064
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5144 -childID 3 -isForBrowser -prefsHandle 5100 -prefMapHandle 5124 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64666d4f-bc29-47cf-aa17-e81b830e3a10} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
                3⤵
                  PID:840
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5276 -childID 4 -isForBrowser -prefsHandle 5284 -prefMapHandle 5288 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95ec6de9-e0c6-4c98-9206-9f075449811a} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
                  3⤵
                    PID:2096
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5468 -childID 5 -isForBrowser -prefsHandle 5476 -prefMapHandle 5480 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f81c10fd-ce76-46c3-b44c-48549c5c6aae} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
                    3⤵
                      PID:5056
                • C:\Windows\System32\rundll32.exe
                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                  1⤵
                    PID:2472
                  • C:\Windows\System32\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Document_g23_20u196809-89b27771u5582-0320b4.js"
                    1⤵
                    • Blocklisted process makes network request
                    • Modifies system certificate store
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1776
                  • C:\Windows\system32\msiexec.exe
                    C:\Windows\system32\msiexec.exe /V
                    1⤵
                    • Blocklisted process makes network request
                    • Enumerates connected drives
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:956
                    • C:\Windows\syswow64\MsiExec.exe
                      C:\Windows\syswow64\MsiExec.exe -Embedding 0558FE52BEBEC0201FE38C95AED91052
                      2⤵
                      • Loads dropped DLL
                      PID:2380
                    • C:\Windows\Installer\MSI8776.tmp
                      "C:\Windows\Installer\MSI8776.tmp" C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Local\glosar\beta.dll, homq
                      2⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5284
                  • C:\Windows\System32\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\glosar\beta.dll, homq
                    1⤵
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5324
                    • C:\Windows\System32\rundll32.exe
                      rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_39016c1b.dll", homq
                      2⤵
                      • Loads dropped DLL
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5352

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Config.Msi\e5786d5.rbs

                    Filesize

                    1KB

                    MD5

                    116958c989e0b867e5fdd112d92699c6

                    SHA1

                    e2677e5385ce61775e44eccdf45ac9e95a42ce6b

                    SHA256

                    68c781e9669f230f6416ee0bf01ede2631c71fb54b4accf7934dec1335020510

                    SHA512

                    81b936c266846a6c2bfb36e8e49a239b852680d1cf35d949754859ce17598607094e5e3edffce9f6ac10c221c1d6d28f2f7bf2cd26f53478b87afde5971f055d

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                    Filesize

                    479KB

                    MD5

                    09372174e83dbbf696ee732fd2e875bb

                    SHA1

                    ba360186ba650a769f9303f48b7200fb5eaccee1

                    SHA256

                    c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                    SHA512

                    b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                    Filesize

                    13.8MB

                    MD5

                    0a8747a2ac9ac08ae9508f36c6d75692

                    SHA1

                    b287a96fd6cc12433adb42193dfe06111c38eaf0

                    SHA256

                    32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                    SHA512

                    59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                  • C:\Users\Admin\AppData\Local\glosar\beta.dll

                    Filesize

                    364KB

                    MD5

                    a1c84c14a82f2cbb7e9a5f253d721159

                    SHA1

                    3aa5e70111c290c45daac06984281dfb5439115b

                    SHA256

                    53e65d071870f127bc6bf6c8e8ddfd131558153513976744ee7460eeb766d081

                    SHA512

                    f76691853fa45d93246dfd8569af5ec7e66fdd7536241b92ee10bb9202b0502e66dfd030fe539956fb28fe20e71b33cae524038c356facf555d4a130c64665ed

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\AlternateServices.bin

                    Filesize

                    8KB

                    MD5

                    5d0eb1c5fe8a09507cbda40acb2b8ef4

                    SHA1

                    093f2d5e1739832c7770d96a0494c717b585519a

                    SHA256

                    704c1f8524535f9828a71a7dc50cff8db3d1c88e1f18fdaca5e35c8d18271656

                    SHA512

                    47b7dce530b5610d42d296f579a5c8e1fbc63527851f1d45694ec2aacafbf67f8cfe9c07b48f4758439f0d7ceb26b78cc9a27ebbc85c71d436fdc5c3fb7a9435

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    21KB

                    MD5

                    5ca1df05e7756f7a3b3f2793e996145d

                    SHA1

                    51ede5efebb4d3b678b4359f0d359fa57f802b2a

                    SHA256

                    d2e7ee6e860794ea49c7f7ae82dc7c74575ba2dbaaedf7ede66c5088795edcc3

                    SHA512

                    eb33a9e9a31588a77e339bfcb6de3a30828343eeef473ca38b629d6aa881b60c680fb8df4c7d9697cfea2bc89ca8d55055151b021a01a1b81f4922da4aba12fe

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    22KB

                    MD5

                    2bccb89e0f46c8a44e69a9f045d852b3

                    SHA1

                    fba13fa197f831315e5e53ea60d6933341ac3b04

                    SHA256

                    ba1d81e1734ce72b54ee5752f9adca0e05248197ed07bfe653eb401b61113090

                    SHA512

                    587ebc75a6302ae665d5a68c5d3b85d6f7bf4f79acd053bab3a26250eb0f2c5b370c1170f21ef52e551ac0d99096c94484351d53a2eec2a484337db20fa0a13b

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    21KB

                    MD5

                    d3c0d9bb43ce492ac499d85c87dcfd26

                    SHA1

                    b998ae5710ef8194d1b1a8087b3b83b8771b7c7d

                    SHA256

                    1d8e08b937c05709231afd93cd492d9bcce939b09911890e2810852e1f5e7122

                    SHA512

                    4aa86cd43e4ab739d849142516d259db12f40cbdef14b91cf2cb304d2608ee72c6c935a51e332909cac346ee105300e741c9518fe6805b325d42573b623d3805

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\datareporting\glean\pending_pings\0e5c6554-5e39-45b1-841a-b2f0c5b427b0

                    Filesize

                    659B

                    MD5

                    531066bcbc7597278f3761e45fecebdd

                    SHA1

                    325f35a89aedac4319a8413a7f83d52db70e9434

                    SHA256

                    6f110985c134b368688a191d393e8ab5cd30327baca20851ef5a9be282e3a75e

                    SHA512

                    fb83c27d40305ce6e30c615c338c28a3c19db4526d88b91886ab5571e4b965c5084621a8e9ffc532c7e7bc6a89a5391d2cc8ef0e9e53e1f5672936d8433c1211

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\datareporting\glean\pending_pings\8b8bff00-c90f-4fea-a503-546e1dc8aa25

                    Filesize

                    982B

                    MD5

                    0a62618c5b533b35cfe086443d8f5f90

                    SHA1

                    3ae1668d4c9b98a1c42a11df3e03b4b679c71aba

                    SHA256

                    2f69ebebe62d83f323c19221900404907b317cd62a74d3376fc15f545b49fc0e

                    SHA512

                    b979a054829765e94f6fe55a3a95ad0b84b4110ab74b67ff029e29a704cc5cba8e6d4cb827cc4a2e173a39a1405e46bae9d60b6a152dda9b23ea1d7d45ec8c60

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                    Filesize

                    1.1MB

                    MD5

                    842039753bf41fa5e11b3a1383061a87

                    SHA1

                    3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                    SHA256

                    d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                    SHA512

                    d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                    Filesize

                    116B

                    MD5

                    2a461e9eb87fd1955cea740a3444ee7a

                    SHA1

                    b10755914c713f5a4677494dbe8a686ed458c3c5

                    SHA256

                    4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                    SHA512

                    34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                    Filesize

                    372B

                    MD5

                    bf957ad58b55f64219ab3f793e374316

                    SHA1

                    a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                    SHA256

                    bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                    SHA512

                    79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                    Filesize

                    17.8MB

                    MD5

                    daf7ef3acccab478aaa7d6dc1c60f865

                    SHA1

                    f8246162b97ce4a945feced27b6ea114366ff2ad

                    SHA256

                    bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                    SHA512

                    5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\prefs-1.js

                    Filesize

                    9KB

                    MD5

                    14e912c3316b3be14d3e2bf9dec16e7f

                    SHA1

                    858a35d4d54bc322af7e26b42b16166cab1d7fcf

                    SHA256

                    a29ec0df706513eae5759a30eb84e4289983d5c5897e961aa0ea91cd7c876377

                    SHA512

                    0a56738a316acc1c2ee5d89b61069851582b2ae772f0e1be01755c16fbbd50848777c20d02171e105bfc7104fc7f328b2eb4f6ccb5b771425cc9c931a84822a8

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\prefs-1.js

                    Filesize

                    8KB

                    MD5

                    8f7f59c79614fa11e35630381dcd923b

                    SHA1

                    48e5a7e06b09b446c0c35a2f137dcb4b5c44ab98

                    SHA256

                    962964b280d50ecc79f712c033e523b431f4df5a0003c52129ed4ea870cf6954

                    SHA512

                    47206d6e33f56288697e75f0a50837e95b023cea1539cf6d1d02d338846e5314eead308ecf46ef1a1ec681fb10f1c2cff5a5729f0eab4729f43d7e8205fc3c16

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ihcffylf.default-release\prefs.js

                    Filesize

                    8KB

                    MD5

                    3d1089a97f2fd2c322e501be1663efd7

                    SHA1

                    c329f10b7b04079831aae4f48e43d1a69fd298c7

                    SHA256

                    6cee73b4ae8d5b71fae24beaf88d77209e858188ca883fb8dde4be00e7dbcaa2

                    SHA512

                    0f41794b50ce57cce4e9f4cd253a8a646ebff63aea195ad4317f2ae67b8ac312b97014bdc66105e2436629cc67624c36df07b5a3e5425b75e4a1dd64bb78da8e

                  • C:\Users\Admin\Downloads\Document_g23_20u196809-89b27771u5582-0320b4.5ojAU65p.js.part

                    Filesize

                    533KB

                    MD5

                    4e825c9f306560e7ebef828b06eddcd2

                    SHA1

                    0be9284707a59ebf84bde7375beb1a0d00037b3e

                    SHA256

                    8720c588cc94e880ce004b31858a70d54edd06b7bd7e6ab68c9c35ae3253e3a6

                    SHA512

                    ebb17b59d00beec8fac26d2cb8320018f7d7e0df6fcede27f45f15d98d906f5c9afc2b7f8d0ced18023cd90fc5f2fae6bdf46683479fe7ca8db8c19c9c2ca585

                  • C:\Windows\Installer\MSI8388.tmp

                    Filesize

                    1.3MB

                    MD5

                    f83ed040b4e52088817df73ef51fe0d3

                    SHA1

                    3d011c54ae9a66ef2a865afd694712b338feed5d

                    SHA256

                    a9fa025fe912c8ad5e6566c675e045732c4d89f4187bfd94c4e916dd9fe25417

                    SHA512

                    c4fe6171f4590a3f588bba5818d05ed525619fc3333f911ea785bebea11788f144b71974254f6dbf270a2b89f9c21698d882d378274cf63005223fe5618d15f0

                  • C:\Windows\Installer\MSI85FA.tmp

                    Filesize

                    436KB

                    MD5

                    475d20c0ea477a35660e3f67ecf0a1df

                    SHA1

                    67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

                    SHA256

                    426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

                    SHA512

                    99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

                  • C:\Windows\Installer\MSI8776.tmp

                    Filesize

                    389KB

                    MD5

                    b9545ed17695a32face8c3408a6a3553

                    SHA1

                    f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

                    SHA256

                    1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

                    SHA512

                    f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

                  • memory/5324-384-0x0000000180000000-0x0000000180066000-memory.dmp

                    Filesize

                    408KB

                  • memory/5352-398-0x0000024471B00000-0x0000024471B14000-memory.dmp

                    Filesize

                    80KB