Analysis
- max time kernel
94s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
13/09/2024, 01:07
General
- Target 2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061.dll
- Size 1.8MB
- Sample240913-bgt4pswalk
- SHA256 2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061
Score
10/10
Malware Config
Signatures
- Detects Latrodectus 6 IoCs
Detects Latrodectus v1.4.
- Latrodectus loader
Latrodectus is a loader written in C++.
- Deletes itself 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061.dll,#11⤵
- Deletes itself
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_2bc585e8.dll", #12⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Update_2bc585e8.dll
memory/2724-8-0x0000021DC5F20000-0x0000021DC5F36000-memory.dmp
memory/2724-9-0x0000021DC5F20000-0x0000021DC5F36000-memory.dmp
memory/4768-0-0x000001D165650000-0x000001D165666000-memory.dmp
memory/4768-1-0x000001D165650000-0x000001D165666000-memory.dmp
memory/4768-3-0x000001D165650000-0x000001D165666000-memory.dmp
memory/4768-7-0x000001D165650000-0x000001D165666000-memory.dmp
memory/4768-5-0x0000000180000000-0x00000001801DC000-memory.dmp