latrodectus | 80f7accfb59a72d82e38922cd25caabec2f223dd570789fe70baf7bf28192f64

Analysis

max time kernel
829s
max time network
1139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2024 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

update_eef80614.exe
Size

2.8MB
MD5

acf36a2df594ab9c5d62b3f119c474b5
SHA1

0f18ef518e7ed85accaac1bffd347953f0f46596
SHA256

80f7accfb59a72d82e38922cd25caabec2f223dd570789fe70baf7bf28192f64
SHA512

0478ca4fdd64447cf7f66cb20a2537c3959cecc05c0b5d38e043289bead7c1ae560aaa96a1acd07711c4e6f3a26194e66a987ad30e350005064acc989961879a
SSDEEP

24576:Q1DqrUzoecOL6ojp8wyXByS0DE2zj9A0rVfupK58gwJQodPH25dMR1uaCDi+jz0p:Q1xcOzNXyRxmE217WpK5mQo

Score

10^/10

latrodectus loader

Malware Config

Signatures

Detects Latrodectus 3 IoCs

Detects Latrodectus v1.4.

resource	yara_rule
behavioral1/memory/5016-1-0x000001623FAA0000-0x000001623FAB5000-memory.dmp	family_latrodectus_1_4
behavioral1/memory/5016-7-0x000001623FAA0000-0x000001623FAB5000-memory.dmp	family_latrodectus_1_4
behavioral1/memory/4772-8-0x0000015C19FF0000-0x0000015C1A005000-memory.dmp	family_latrodectus_1_4

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Deletes itself 1 IoCs

pid	Process
5016	update_eef80614.exe

Executes dropped EXE 3 IoCs

pid	Process
4772	Update_71112850.exe
3036	Update_71112850.exe
3676	Update_71112850.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5016	update_eef80614.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4772	5016	update_eef80614.exe	87
PID 5016 wrote to memory of 4772	5016	update_eef80614.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\update_eef80614.exe
"C:\Users\Admin\AppData\Local\Temp\update_eef80614.exe"
1⤵
- Deletes itself
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Roaming\Custom_update\Update_71112850.exe
  "C:\Users\Admin\AppData\Roaming\Custom_update\Update_71112850.exe"
  2⤵
  - Executes dropped EXE
  PID:4772

C:\Users\Admin\AppData\Roaming\Custom_update\Update_71112850.exe
C:\Users\Admin\AppData\Roaming\Custom_update\Update_71112850.exe
1⤵
- Executes dropped EXE
PID:3036

C:\Users\Admin\AppData\Roaming\Custom_update\Update_71112850.exe
C:\Users\Admin\AppData\Roaming\Custom_update\Update_71112850.exe
1⤵
- Executes dropped EXE
PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Custom_update\Update_71112850.exe

Filesize
2.8MB

MD5
acf36a2df594ab9c5d62b3f119c474b5

SHA1
0f18ef518e7ed85accaac1bffd347953f0f46596

SHA256
80f7accfb59a72d82e38922cd25caabec2f223dd570789fe70baf7bf28192f64

SHA512
0478ca4fdd64447cf7f66cb20a2537c3959cecc05c0b5d38e043289bead7c1ae560aaa96a1acd07711c4e6f3a26194e66a987ad30e350005064acc989961879a

Download Submit
memory/4772-8-0x0000015C19FF0000-0x0000015C1A005000-memory.dmp

Filesize
84KB

Download
memory/5016-1-0x000001623FAA0000-0x000001623FAB5000-memory.dmp

Filesize
84KB

Download
memory/5016-0-0x00000162412E0000-0x00000162413E5000-memory.dmp

Filesize
1.0MB

Download
memory/5016-6-0x00007FF6D00D0000-0x00007FF6D039B000-memory.dmp

Filesize
2.8MB

Download
memory/5016-7-0x000001623FAA0000-0x000001623FAB5000-memory.dmp

Filesize
84KB

Download