latrodectus | 2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061

General

Target

130920240346tz3.dll
Size

1.8MB
MD5

6dc0d350d735fd1acc8219cfa5d02b9b
SHA1

7ba0708a4404715fb21a23acfbd88a25b7245ef1
SHA256

2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061
SHA512

99c9b6310363ce3a7d9ff680c4a0ae976553fc4789b12f9b60d9f629608d90cf4d64b4c8a037264f8aaa48fba69ae397236ef4c32c2eb6779fb5d9e0b3b0d52f
SSDEEP

24576:jn6mclQ1O/p0g/9fTeVB1SATDqj2/lDRa+QR6P3r3dl60NWEEk6d:jnhclke0wfoHSASyNNFI6P3rNlHNp

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

C2

https://isomicrotich.com/test/

https://rilomenifis.com/test/

Signatures

Detects Latrodectus 6 IoCs

Detects Latrodectus v1.4.

resource	yara_rule
behavioral2/memory/2472-0-0x0000015284BD0000-0x0000015284BE6000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/2472-1-0x0000015284BD0000-0x0000015284BE6000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/2472-2-0x0000015284BD0000-0x0000015284BE6000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/2472-6-0x0000015284BD0000-0x0000015284BE6000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/2352-8-0x000002AC41CC0000-0x000002AC41CD6000-memory.dmp	family_latrodectus_1_4
behavioral2/memory/2352-9-0x000002AC41CC0000-0x000002AC41CD6000-memory.dmp	family_latrodectus_1_4

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Deletes itself 1 IoCs

pid	Process
2472	rundll32.exe

Loads dropped DLL 2 IoCs

pid	Process
2352	rundll32.exe
4244	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2472	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2352	2472	rundll32.exe	83
PID 2472 wrote to memory of 2352	2472	rundll32.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\130920240346tz3.dll,#1
1⤵
- Deletes itself
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\system32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_2bc585e8.dll", #1
  2⤵
  - Loads dropped DLL
  PID:2352

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_2bc585e8.dll", #1
1⤵
- Loads dropped DLL
PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Custom_update\Update_2bc585e8.dll

Filesize
1.5MB

MD5
78b292ea68ba65b4fe8948384b82f591

SHA1
97854f1546395d29fa6f3874b00b89e2307cfee2

SHA256
3f00363f2dc8c603650b9f0dbc0dbed4099dc97e0bd61cf6d524e2377b618b88

SHA512
7639b6d093e0e5bcc23452619ff8ff7321e3c835195a631d834710facc5a4ae0daad85ddfeefdeb7a2bcacb18a2c0483c63f4833952216e9737e3a8b9714ca97

Download Submit
C:\Users\Admin\AppData\Roaming\Custom_update\Update_2bc585e8.dll

Filesize
1.8MB

MD5
6dc0d350d735fd1acc8219cfa5d02b9b

SHA1
7ba0708a4404715fb21a23acfbd88a25b7245ef1

SHA256
2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061

SHA512
99c9b6310363ce3a7d9ff680c4a0ae976553fc4789b12f9b60d9f629608d90cf4d64b4c8a037264f8aaa48fba69ae397236ef4c32c2eb6779fb5d9e0b3b0d52f

Download Submit
memory/2352-8-0x000002AC41CC0000-0x000002AC41CD6000-memory.dmp

Filesize
88KB

Download
memory/2352-9-0x000002AC41CC0000-0x000002AC41CD6000-memory.dmp

Filesize
88KB

Download
memory/2472-0-0x0000015284BD0000-0x0000015284BE6000-memory.dmp

Filesize
88KB

Download
memory/2472-1-0x0000015284BD0000-0x0000015284BE6000-memory.dmp

Filesize
88KB

Download
memory/2472-2-0x0000015284BD0000-0x0000015284BE6000-memory.dmp

Filesize
88KB

Download
memory/2472-6-0x0000015284BD0000-0x0000015284BE6000-memory.dmp

Filesize
88KB

Download
memory/2472-4-0x0000000180000000-0x00000001801DC000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing