latrodectus | 2674b6d7c8da0c3be4a2203f9d7ad48875869585a6e325ff7a36926771803d95

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
30/07/2024, 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830.exe
Size

6.3MB
MD5

db60dc357835c7379091e4f54c2f6f0e
SHA1

e9ecdb514686ba2707e2a6e4d8e8b28a06596d88
SHA256

62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830
SHA512

0116b2817fa9295cf69490a2020b82d9d6157268f227feedcd74bc23246182a8de2c88a48bd1a25cfa3051a2fbafa2be3b5959e3be8f02ab379f15b8e1558c7b
SSDEEP

98304:E08tPgotZXlKbXynnR6a8SPgJevPQ+pit+IaGcYVUFwBRXAn6l7CgTV8+pYIKu5W:EJLQXynRea3PQ+ppYVUFKRQL+u/uNm

Score

10^/10

latrodectus discovery loader

Malware Config

Extracted

Family

latrodectus

https://spikeliftall.com/live/

https://godfaetret.com/live/

Signatures

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Executes dropped EXE 4 IoCs

pid	Process
3640	TVIYAUUXRW.exe
1964	CODWLWRUMZ.exe
3468	confrontation_1029e9d2.exe
4988	confrontation_1029e9d2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CODWLWRUMZ.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3640	TVIYAUUXRW.exe
3640	TVIYAUUXRW.exe
3640	TVIYAUUXRW.exe
3640	TVIYAUUXRW.exe
3468	confrontation_1029e9d2.exe
3468	confrontation_1029e9d2.exe
3468	confrontation_1029e9d2.exe
3468	confrontation_1029e9d2.exe
1964	CODWLWRUMZ.exe
1964	CODWLWRUMZ.exe
4988	confrontation_1029e9d2.exe
4988	confrontation_1029e9d2.exe
4988	confrontation_1029e9d2.exe
4988	confrontation_1029e9d2.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 3468	3640	TVIYAUUXRW.exe	96
PID 3640 wrote to memory of 3468	3640	TVIYAUUXRW.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830.exe
"C:\Users\Admin\AppData\Local\Temp\62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830.exe"
1⤵
PID:1748
- C:\Users\Admin\AppData\Local\Temp\TVIYAUUXRW.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_1029e9d2.exe
    "C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_1029e9d2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3468
- C:\Users\Admin\AppData\Local\Temp\CODWLWRUMZ.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1964

C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_1029e9d2.exe
C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_1029e9d2.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CODWLWRUMZ.exe

Filesize
5.7MB

MD5
de07e3ab87e46ac0b9a75687e5c61db6

SHA1
4c0bbfdcbad96e817e6777589b6bea8c40851e6e

SHA256
532c9bc2e30150bef61a050386509dd5f3c152688898f6be616393f10b9262d3

SHA512
d5201bc5e269c28a8523cbe2a450178e6265047bf38e1fecd60d0eb90160a3853c5b5cf424a39492599f556d341f2c6bcc934871b988a0e8729b9c6440ff273b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TVIYAUUXRW.exe

Filesize
367KB

MD5
e1a8ca0eb72cbdd2a372c69a355d42be

SHA1
3d52f700bdb8e35ecbdd4238c2c4ca34644c467e

SHA256
81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb

SHA512
5a52f994513cb35ea2dbe85a330753517620a1f2aaba01de7517792491ee480f1db06cd943b16a5f6e6837001e51a2e6fcf6d8e6939b81b9279a36359a3a08eb

Download Submit
memory/1964-14-0x0000000002240000-0x00000000022DB000-memory.dmp

Filesize
620KB

Download
memory/3468-12-0x0000000140000000-0x0000000140014000-memory.dmp

Filesize
80KB

Download
memory/3640-4-0x0000000140000000-0x0000000140014000-memory.dmp

Filesize
80KB

Download
memory/3640-11-0x0000000140000000-0x0000000140014000-memory.dmp

Filesize
80KB

Download
memory/3640-10-0x00007FF6201D0000-0x00007FF6214AD000-memory.dmp

Filesize
18.9MB

Download