Analysis

  • max time kernel
    31s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    16-07-2024 13:45

General

  • Target

    08075e8a6dcc6a5fca089348edbd5fc07b2b0b26a26a46e0dd401121fdaa88d3.msi

  • Size

    1.6MB

  • MD5

    b1532277024424c2071f0293eb39431a

  • SHA1

    ca7b962b28407f02f715a1cd8e027146184342a2

  • SHA256

    08075e8a6dcc6a5fca089348edbd5fc07b2b0b26a26a46e0dd401121fdaa88d3

  • SHA512

    30c1e2468a8277d41befda9d855be34617d3cb143e047a4aaeb070e948ccb615d636c5942a45278bd947f14dae78c1c92126fd8cc88224c5c132a7440e8de1f1

  • SSDEEP

    49152:6VUvYIW8zBQSc0ZnSKeZKumZr7A4iTBdx:BYP0ZncK/A4iFf

Malware Config

Extracted

Family

latrodectus

C2

https://winarkamaps.com/live/

https://stratimasesstr.com/live/

Signatures

  • Latrodectus loader

    Latrodectus is a loader written in C++.

  • Detect larodectus Loader variant 2 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\08075e8a6dcc6a5fca089348edbd5fc07b2b0b26a26a46e0dd401121fdaa88d3.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2388
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:972
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 71312417914DA154F305FCAA57428627 C
      2⤵
      • Loads dropped DLL
      PID:2884
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 15491BD03CADA0F54EDC948532F36F59
      2⤵
      • Loads dropped DLL
      PID:3056
    • C:\Windows\Installer\MSIA69E.tmp
      "C:\Windows\Installer\MSIA69E.tmp" C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\digistamp\360Util.dll, homq
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1084
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:2848
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003F4" "00000000000005F0"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:2596
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\digistamp\360Util.dll, homq
      1⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:1748

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\f789fca.rbs

      Filesize

      1KB

      MD5

      a8f045127507c29933343c01de2251cf

      SHA1

      bec3d6f78c7849e3522e4109f4bda5f0816a6ed2

      SHA256

      ec7d24abc1ea25e61a8c50c954806f9efc80fd20f1b7d812cfb52be6e94d634a

      SHA512

      dfa007d8980be140166c5b500232f9c0b484cf83d1ae71a74b6f6c03541052d7d12bb9de3adedf3b8dfe307045b016813d8f793d106690ae5e78554bcef592b9

    • C:\Users\Admin\AppData\Local\Temp\MSI3BE8.tmp

      Filesize

      436KB

      MD5

      475d20c0ea477a35660e3f67ecf0a1df

      SHA1

      67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

      SHA256

      426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

      SHA512

      99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

    • C:\Windows\Installer\MSIA69E.tmp

      Filesize

      389KB

      MD5

      b9545ed17695a32face8c3408a6a3553

      SHA1

      f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

      SHA256

      1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

      SHA512

      f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

    • \Users\Admin\AppData\Local\digistamp\360Util.dll

      Filesize

      895KB

      MD5

      d158665d5beda7f0fd02fe0a0b78d0a3

      SHA1

      2decd5a2fb6f85414a2b7b0c0d314a60c517e562

      SHA256

      8ed1ba513b298c2dea57d5d47b3bdb8dc3d622e8e8b64ed244633ae8ccab8cfc

      SHA512

      78499c3d04d7cc2a24aaead4644530647f8c6d5ce5fb03fa88b99f58429d86208371a92e138405948c47ff7672fc37bc3418f52d2b1ff924c262b207c8785b18

    • memory/1084-37-0x00000000001B0000-0x00000000001B2000-memory.dmp

      Filesize

      8KB

    • memory/1748-43-0x0000000180000000-0x0000000180186000-memory.dmp

      Filesize

      1.5MB

    • memory/1748-44-0x0000000180000000-0x0000000180186000-memory.dmp

      Filesize

      1.5MB

    • memory/1748-45-0x0000000180000000-0x0000000180186000-memory.dmp

      Filesize

      1.5MB

    • memory/1748-47-0x0000000001B00000-0x0000000001B14000-memory.dmp

      Filesize

      80KB

    • memory/1748-51-0x0000000180000000-0x0000000180186000-memory.dmp

      Filesize

      1.5MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.