latrodectus | f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c

Resubmissions

25-08-2024 10:55

240825-mz9snasdql 10

25-08-2024 09:03

240825-k1g3xswbnf 10

25-08-2024 08:53

240825-ktjyyavhlb 10

Analysis

max time kernel
146s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
25-08-2024 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe
Size

2.3MB
MD5

9fb83bee6ff97065c498f48fc094f848
SHA1

860112de5e833eb5fd9abaaf6db7c881c13220f8
SHA256

f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c
SHA512

103f87414802d1edd3d932626a370cd8b3e37666d541e7550257ffa5f5e6b0ce357f11dd14f13a5ff831d02da6a596d101682adf68855c1982093da03bdf8a96
SSDEEP

49152:YMLtHPldWW5afLAUCweyFI0ZBAFCGLcRe2xTIYLEs:j5aMUzRe2M

Score

10^/10

latrodectus loader

Malware Config

Signatures

Detects Latrodectus 6 IoCs

Detects Latrodectus v1.4.

resource	yara_rule
behavioral2/memory/1584-0-0x0000000000590000-0x00000000005A6000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/1584-1-0x0000000000590000-0x00000000005A6000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/1584-2-0x0000000000590000-0x00000000005A6000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/1584-8-0x0000000000590000-0x00000000005A6000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/1548-9-0x0000000001F40000-0x0000000001F56000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/1548-10-0x0000000001F40000-0x0000000001F56000-memory.dmp	family_latrodectus_1_4

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Deletes itself 1 IoCs

pid	Process
1584	f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe

Executes dropped EXE 2 IoCs

pid	Process
1548	Update_590539eb.exe
4628	Update_590539eb.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1584	f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 1548	1584	f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe	82
PID 1584 wrote to memory of 1548	1584	f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe
"C:\Users\Admin\AppData\Local\Temp\f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe"
1⤵
- Deletes itself
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Roaming\Custom_update\Update_590539eb.exe
  "C:\Users\Admin\AppData\Roaming\Custom_update\Update_590539eb.exe"
  2⤵
  - Executes dropped EXE
  PID:1548

C:\Users\Admin\AppData\Roaming\Custom_update\Update_590539eb.exe
C:\Users\Admin\AppData\Roaming\Custom_update\Update_590539eb.exe
1⤵
- Executes dropped EXE
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Custom_update\Update_590539eb.exe

Filesize
2.3MB

MD5
9fb83bee6ff97065c498f48fc094f848

SHA1
860112de5e833eb5fd9abaaf6db7c881c13220f8

SHA256
f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c

SHA512
103f87414802d1edd3d932626a370cd8b3e37666d541e7550257ffa5f5e6b0ce357f11dd14f13a5ff831d02da6a596d101682adf68855c1982093da03bdf8a96

Download Submit
memory/1548-9-0x0000000001F40000-0x0000000001F56000-memory.dmp

Filesize
88KB

Download
memory/1548-10-0x0000000001F40000-0x0000000001F56000-memory.dmp

Filesize
88KB

Download
memory/1584-0-0x0000000000590000-0x00000000005A6000-memory.dmp

Filesize
88KB

Download
memory/1584-1-0x0000000000590000-0x00000000005A6000-memory.dmp

Filesize
88KB

Download
memory/1584-2-0x0000000000590000-0x00000000005A6000-memory.dmp

Filesize
88KB

Download
memory/1584-8-0x0000000000590000-0x00000000005A6000-memory.dmp

Filesize
88KB

Download
memory/1584-6-0x0000000140000000-0x0000000140254000-memory.dmp

Filesize
2.3MB

Download