latrodectus | f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c

Analysis

max time kernel
138s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe
Size

2.3MB
MD5

9fb83bee6ff97065c498f48fc094f848
SHA1

860112de5e833eb5fd9abaaf6db7c881c13220f8
SHA256

f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c
SHA512

103f87414802d1edd3d932626a370cd8b3e37666d541e7550257ffa5f5e6b0ce357f11dd14f13a5ff831d02da6a596d101682adf68855c1982093da03bdf8a96
SSDEEP

49152:YMLtHPldWW5afLAUCweyFI0ZBAFCGLcRe2xTIYLEs:j5aMUzRe2M

Score

10^/10

latrodectus loader

Malware Config

Signatures

Detects Latrodectus 7 IoCs

Detects Latrodectus v1.4.

resource	yara_rule
behavioral1/memory/2380-0-0x0000000000190000-0x00000000001A6000-memory.dmp	family_latrodectus_1_4
behavioral1/memory/2380-1-0x0000000000190000-0x00000000001A6000-memory.dmp	family_latrodectus_1_4
behavioral1/memory/2380-2-0x0000000000190000-0x00000000001A6000-memory.dmp	family_latrodectus_1_4
behavioral1/memory/2380-8-0x0000000000190000-0x00000000001A6000-memory.dmp	family_latrodectus_1_4
behavioral1/memory/2400-9-0x0000000000200000-0x0000000000216000-memory.dmp	family_latrodectus_1_4
behavioral1/memory/2400-10-0x0000000000200000-0x0000000000216000-memory.dmp	family_latrodectus_1_4
behavioral1/memory/2400-12-0x0000000000200000-0x0000000000216000-memory.dmp	family_latrodectus_1_4

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Deletes itself 1 IoCs

pid	Process
2380	f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe

Executes dropped EXE 2 IoCs

pid	Process
2400	Update_479dec3f.exe
1844	Update_479dec3f.exe

Loads dropped DLL 1 IoCs

pid	Process
2380	f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2380	f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2400	2380	f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe	30
PID 2380 wrote to memory of 2400	2380	f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe	30
PID 2380 wrote to memory of 2400	2380	f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe	30
PID 2824 wrote to memory of 1844	2824	taskeng.exe	33
PID 2824 wrote to memory of 1844	2824	taskeng.exe	33
PID 2824 wrote to memory of 1844	2824	taskeng.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe
"C:\Users\Admin\AppData\Local\Temp\f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe"
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Roaming\Custom_update\Update_479dec3f.exe
  "C:\Users\Admin\AppData\Roaming\Custom_update\Update_479dec3f.exe"
  2⤵
  - Executes dropped EXE
  PID:2400

C:\Windows\system32\taskeng.exe
taskeng.exe {413C489B-B759-45E9-BFD3-781B7E3D4C08} S-1-5-21-3450744190-3404161390-554719085-1000:PDIZKVQX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Users\Admin\AppData\Roaming\Custom_update\Update_479dec3f.exe
  C:\Users\Admin\AppData\Roaming\Custom_update\Update_479dec3f.exe
  2⤵
  - Executes dropped EXE
  PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Custom_update\Update_479dec3f.exe

Filesize
2.3MB

MD5
9fb83bee6ff97065c498f48fc094f848

SHA1
860112de5e833eb5fd9abaaf6db7c881c13220f8

SHA256
f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c

SHA512
103f87414802d1edd3d932626a370cd8b3e37666d541e7550257ffa5f5e6b0ce357f11dd14f13a5ff831d02da6a596d101682adf68855c1982093da03bdf8a96

Download Submit
memory/2380-0-0x0000000000190000-0x00000000001A6000-memory.dmp

Filesize
88KB

Download
memory/2380-1-0x0000000000190000-0x00000000001A6000-memory.dmp

Filesize
88KB

Download
memory/2380-2-0x0000000000190000-0x00000000001A6000-memory.dmp

Filesize
88KB

Download
memory/2380-8-0x0000000000190000-0x00000000001A6000-memory.dmp

Filesize
88KB

Download
memory/2380-7-0x0000000140000000-0x0000000140254000-memory.dmp

Filesize
2.3MB

Download
memory/2400-9-0x0000000000200000-0x0000000000216000-memory.dmp

Filesize
88KB

Download
memory/2400-10-0x0000000000200000-0x0000000000216000-memory.dmp

Filesize
88KB

Download
memory/2400-12-0x0000000000200000-0x0000000000216000-memory.dmp

Filesize
88KB

Download