Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • submitted
    17/09/2024, 08:27

General

  • Target

    f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe

  • Size

    2.3MB

  • MD5

    9fb83bee6ff97065c498f48fc094f848

  • SHA1

    860112de5e833eb5fd9abaaf6db7c881c13220f8

  • SHA256

    f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c

  • SHA512

    103f87414802d1edd3d932626a370cd8b3e37666d541e7550257ffa5f5e6b0ce357f11dd14f13a5ff831d02da6a596d101682adf68855c1982093da03bdf8a96

  • SSDEEP

    49152:YMLtHPldWW5afLAUCweyFI0ZBAFCGLcRe2xTIYLEs:j5aMUzRe2M

Score
10/10

Malware Config

Extracted

Family

latrodectus

C2

https://pomaspoteraka.com/test/

https://finilamedima.com/test/

Signatures

  • Detects Latrodectus 7 IoCs

    Detects Latrodectus v1.4.

  • Latrodectus family
  • Latrodectus loader

    Latrodectus is a loader written in C++.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe
    "C:\Users\Admin\AppData\Local\Temp\f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c.exe"
    1⤵
    • Deletes itself
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Users\Admin\AppData\Roaming\Custom_update\Update_893835d6.exe
      "C:\Users\Admin\AppData\Roaming\Custom_update\Update_893835d6.exe"
      2⤵
      • Executes dropped EXE
      PID:736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Custom_update\Update_893835d6.exe

    Filesize

    2.3MB

    MD5

    9fb83bee6ff97065c498f48fc094f848

    SHA1

    860112de5e833eb5fd9abaaf6db7c881c13220f8

    SHA256

    f01b02a08c1953e7db9ce61207b121c6efbe986181ba0df1ec205b5909bd856c

    SHA512

    103f87414802d1edd3d932626a370cd8b3e37666d541e7550257ffa5f5e6b0ce357f11dd14f13a5ff831d02da6a596d101682adf68855c1982093da03bdf8a96

  • memory/736-9-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/736-10-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/736-11-0x00000000004D0000-0x00000000004E6000-memory.dmp

    Filesize

    88KB

  • memory/2608-0-0x0000000000510000-0x0000000000526000-memory.dmp

    Filesize

    88KB

  • memory/2608-1-0x0000000000510000-0x0000000000526000-memory.dmp

    Filesize

    88KB

  • memory/2608-2-0x0000000000510000-0x0000000000526000-memory.dmp

    Filesize

    88KB

  • memory/2608-6-0x0000000140000000-0x0000000140254000-memory.dmp

    Filesize

    2.3MB

  • memory/2608-8-0x0000000000510000-0x0000000000526000-memory.dmp

    Filesize

    88KB