latrodectus | 8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0

General

Target

8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe
Size

72KB
MD5

65e2fd12223dc2def303bdfc8e7b628c
SHA1

9ff11679060fce53632641228318e4393cb94dbc
SHA256

8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0
SHA512

20e7298d0964542623e356cb98697f0ed995d3809f5936cd8b21f76bbf52da0f832edec2be7252778647de7795e69fa7f8873b1d4b175b3660b28eb4118dd7e2
SSDEEP

1536:3R8zxbOmOBVjGFV3g5I+va6z5f85NGyPrnRlHl:h8zxqfb5I+xknG6RlF

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

C2

https://castpshost.com/test/

https://trapgnistro.com/test/

Signatures

Detects Latrodectus 2 IoCs

Detects Latrodectus v1.4.

resource	yara_rule
behavioral1/files/0x00070000000186b7-1.dat	family_latrodectus_1_4
behavioral1/memory/2316-8-0x000000013F030000-0x000000013F04400C-memory.dmp	family_latrodectus_1_4

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Deletes itself 1 IoCs

pid	Process
2316	8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe

Executes dropped EXE 1 IoCs

pid	Process
604	Update_356e5b74.exe

Loads dropped DLL 2 IoCs

pid	Process
2316	8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe
2316	8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2316	8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 604	2316	8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe	29
PID 2316 wrote to memory of 604	2316	8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe	29
PID 2316 wrote to memory of 604	2316	8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe	29
PID 2316 wrote to memory of 2264	2316	8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe	30
PID 2316 wrote to memory of 2264	2316	8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe	30
PID 2316 wrote to memory of 2264	2316	8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe	30

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe
"C:\Users\Admin\AppData\Local\Temp\8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0.exe"
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Roaming\Custom_update\Update_356e5b74.exe
  "C:\Users\Admin\AppData\Roaming\Custom_update\Update_356e5b74.exe"
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2316 -s 252
  2⤵
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Custom_update\Update_356e5b74.exe

Filesize
72KB

MD5
65e2fd12223dc2def303bdfc8e7b628c

SHA1
9ff11679060fce53632641228318e4393cb94dbc

SHA256
8722989a3605360dcaa0bfab56841f4660ea79d495d01b518068f3ce67877ad0

SHA512
20e7298d0964542623e356cb98697f0ed995d3809f5936cd8b21f76bbf52da0f832edec2be7252778647de7795e69fa7f8873b1d4b175b3660b28eb4118dd7e2

Download Submit
memory/2316-8-0x000000013F030000-0x000000013F04400C-memory.dmp

Filesize
80KB

Download

Analysis

Sharing