latrodectus | 62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830

General

Target

62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830.exe
Size

6.3MB
MD5

db60dc357835c7379091e4f54c2f6f0e
SHA1

e9ecdb514686ba2707e2a6e4d8e8b28a06596d88
SHA256

62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830
SHA512

0116b2817fa9295cf69490a2020b82d9d6157268f227feedcd74bc23246182a8de2c88a48bd1a25cfa3051a2fbafa2be3b5959e3be8f02ab379f15b8e1558c7b
SSDEEP

98304:E08tPgotZXlKbXynnR6a8SPgJevPQ+pit+IaGcYVUFwBRXAn6l7CgTV8+pYIKu5W:EJLQXynRea3PQ+ppYVUFKRQL+u/uNm

Score

10^/10

latrodectus discovery loader

Malware Config

Extracted

Family

latrodectus

C2

https://spikeliftall.com/live/

https://godfaetret.com/live/

Signatures

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Executes dropped EXE 6 IoCs

pid	Process
2920	VZWBGRPPWW.exe
4208	SPVOWZTJVX.exe
4908	confrontation_21aca02f.exe
2692	confrontation_21aca02f.exe
3144	confrontation_21aca02f.exe
3800	confrontation_21aca02f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SPVOWZTJVX.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2920	VZWBGRPPWW.exe
2920	VZWBGRPPWW.exe
2920	VZWBGRPPWW.exe
2920	VZWBGRPPWW.exe
4908	confrontation_21aca02f.exe
4908	confrontation_21aca02f.exe
4908	confrontation_21aca02f.exe
4908	confrontation_21aca02f.exe
4208	SPVOWZTJVX.exe
4208	SPVOWZTJVX.exe
2692	confrontation_21aca02f.exe
2692	confrontation_21aca02f.exe
2692	confrontation_21aca02f.exe
2692	confrontation_21aca02f.exe
3144	confrontation_21aca02f.exe
3144	confrontation_21aca02f.exe
3144	confrontation_21aca02f.exe
3144	confrontation_21aca02f.exe
3800	confrontation_21aca02f.exe
3800	confrontation_21aca02f.exe
3800	confrontation_21aca02f.exe
3800	confrontation_21aca02f.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4908	2920	VZWBGRPPWW.exe	84
PID 2920 wrote to memory of 4908	2920	VZWBGRPPWW.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830.exe
"C:\Users\Admin\AppData\Local\Temp\62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830.exe"
1⤵
PID:4680
- C:\Users\Admin\AppData\Local\Temp\VZWBGRPPWW.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_21aca02f.exe
    "C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_21aca02f.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4908
- C:\Users\Admin\AppData\Local\Temp\SPVOWZTJVX.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4208

C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_21aca02f.exe
C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_21aca02f.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2692

C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_21aca02f.exe
C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_21aca02f.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3144

C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_21aca02f.exe
C:\Users\Admin\AppData\Roaming\falsify_steward\confrontation_21aca02f.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SPVOWZTJVX.exe

Filesize
5.7MB

MD5
de07e3ab87e46ac0b9a75687e5c61db6

SHA1
4c0bbfdcbad96e817e6777589b6bea8c40851e6e

SHA256
532c9bc2e30150bef61a050386509dd5f3c152688898f6be616393f10b9262d3

SHA512
d5201bc5e269c28a8523cbe2a450178e6265047bf38e1fecd60d0eb90160a3853c5b5cf424a39492599f556d341f2c6bcc934871b988a0e8729b9c6440ff273b

Download Submit
C:\Users\Admin\AppData\Local\Temp\VZWBGRPPWW.exe

Filesize
367KB

MD5
e1a8ca0eb72cbdd2a372c69a355d42be

SHA1
3d52f700bdb8e35ecbdd4238c2c4ca34644c467e

SHA256
81bc69a33b33949809d630e4fa5cdb89d8c60cf0783f447680c3677cae7bb9bb

SHA512
5a52f994513cb35ea2dbe85a330753517620a1f2aaba01de7517792491ee480f1db06cd943b16a5f6e6837001e51a2e6fcf6d8e6939b81b9279a36359a3a08eb

Download Submit
memory/2920-5-0x00007FFE98E80000-0x00007FFE99089000-memory.dmp

Filesize
2.0MB

Download
memory/2920-10-0x00007FFE98E80000-0x00007FFE99089000-memory.dmp

Filesize
2.0MB

Download
memory/2920-9-0x00007FF7411D0000-0x00007FF7424AD000-memory.dmp

Filesize
18.9MB

Download
memory/4208-15-0x0000000000A40000-0x0000000000ADB000-memory.dmp

Filesize
620KB

Download
memory/4680-0-0x00007FFE98E86000-0x00007FFE98E87000-memory.dmp

Filesize
4KB

Download
memory/4908-13-0x0000000140000000-0x0000000140014000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing