Analysis
- max time kernel
93s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - submitted
18/09/2024, 01:15
Static task
static1
Behavioral task
behavioral1
Sample
4dbb76374e57bb0aeda7f060d7b49fd1c0bba480ab1527dfa0ea009db0383298.msi
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
4dbb76374e57bb0aeda7f060d7b49fd1c0bba480ab1527dfa0ea009db0383298.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 4dbb76374e57bb0aeda7f060d7b49fd1c0bba480ab1527dfa0ea009db0383298.msi
- Size 1.5MB
- Sample240918-bmgessvdjf
- SHA256 4dbb76374e57bb0aeda7f060d7b49fd1c0bba480ab1527dfa0ea009db0383298
- MD5 f1f8dcc624cbbbf64c48207f3ab75587
- SHA1 bd32787754b124da7ecfcc3badc8eaa80de5c90b
- SHA512 5c9892355af5da5389a631ba79df05c39a678d10f0fe9af80c83d4e16681f8e828d22992083dc877117d87434b973a648f308a34797c4e04fd0db93788cafb05
- SSDEEP 24576:XD7xLN3Y2MvZCFlp8zBQSc0ZoCvqK9x0ECIgYmfLVYeBZr7A4mK8OdBsCaatxxo:XD73YhW8zBQSc0ZnSKBZKumZr7A3K8YR
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
latrodectus
C2
-
https://indepahote.com/test/
-
https://pikchestop.com/test/
Signatures
- Detects Latrodectus 1 IoCs
Detects Latrodectus v1.4.
resource yara_rule behavioral2/memory/2052-64-0x0000019F9B970000-0x0000019F9B986000-memory.dmp family_latrodectus_1_4 - Latrodectus family
- Latrodectus loader
Latrodectus is a loader written in C++.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI467A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI46E8.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{62382476-DA56-48A4-AF13-77A93E5AFAD7} msiexec.exe File opened for modification C:\Windows\Installer\MSI4747.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4796.tmp msiexec.exe File created C:\Windows\Installer\e58462c.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\e58462c.msi msiexec.exe - Executes dropped EXE 1 IoCs
pid Process 3496 MSI4796.tmp - Loads dropped DLL 10 IoCs
pid Process 5048 MsiExec.exe 5048 MsiExec.exe 5048 MsiExec.exe 5048 MsiExec.exe 5048 MsiExec.exe 5048 MsiExec.exe 3312 MsiExec.exe 3312 MsiExec.exe 3780 rundll32.exe 2052 rundll32.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3168 msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI4796.tmp - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d6be30f9a4b6bc740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d6be30f90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d6be30f9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd6be30f9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6be30f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5124 msiexec.exe 5124 msiexec.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3168 msiexec.exe Token: SeIncreaseQuotaPrivilege 3168 msiexec.exe Token: SeSecurityPrivilege 5124 msiexec.exe Token: SeCreateTokenPrivilege 3168 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3168 msiexec.exe Token: SeLockMemoryPrivilege 3168 msiexec.exe Token: SeIncreaseQuotaPrivilege 3168 msiexec.exe Token: SeMachineAccountPrivilege 3168 msiexec.exe Token: SeTcbPrivilege 3168 msiexec.exe Token: SeSecurityPrivilege 3168 msiexec.exe Token: SeTakeOwnershipPrivilege 3168 msiexec.exe Token: SeLoadDriverPrivilege 3168 msiexec.exe Token: SeSystemProfilePrivilege 3168 msiexec.exe Token: SeSystemtimePrivilege 3168 msiexec.exe Token: SeProfSingleProcessPrivilege 3168 msiexec.exe Token: SeIncBasePriorityPrivilege 3168 msiexec.exe Token: SeCreatePagefilePrivilege 3168 msiexec.exe Token: SeCreatePermanentPrivilege 3168 msiexec.exe Token: SeBackupPrivilege 3168 msiexec.exe Token: SeRestorePrivilege 3168 msiexec.exe Token: SeShutdownPrivilege 3168 msiexec.exe Token: SeDebugPrivilege 3168 msiexec.exe Token: SeAuditPrivilege 3168 msiexec.exe Token: SeSystemEnvironmentPrivilege 3168 msiexec.exe Token: SeChangeNotifyPrivilege 3168 msiexec.exe Token: SeRemoteShutdownPrivilege 3168 msiexec.exe Token: SeUndockPrivilege 3168 msiexec.exe Token: SeSyncAgentPrivilege 3168 msiexec.exe Token: SeEnableDelegationPrivilege 3168 msiexec.exe Token: SeManageVolumePrivilege 3168 msiexec.exe Token: SeImpersonatePrivilege 3168 msiexec.exe Token: SeCreateGlobalPrivilege 3168 msiexec.exe Token: SeCreateTokenPrivilege 3168 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3168 msiexec.exe Token: SeLockMemoryPrivilege 3168 msiexec.exe Token: SeIncreaseQuotaPrivilege 3168 msiexec.exe Token: SeMachineAccountPrivilege 3168 msiexec.exe Token: SeTcbPrivilege 3168 msiexec.exe Token: SeSecurityPrivilege 3168 msiexec.exe Token: SeTakeOwnershipPrivilege 3168 msiexec.exe Token: SeLoadDriverPrivilege 3168 msiexec.exe Token: SeSystemProfilePrivilege 3168 msiexec.exe Token: SeSystemtimePrivilege 3168 msiexec.exe Token: SeProfSingleProcessPrivilege 3168 msiexec.exe Token: SeIncBasePriorityPrivilege 3168 msiexec.exe Token: SeCreatePagefilePrivilege 3168 msiexec.exe Token: SeCreatePermanentPrivilege 3168 msiexec.exe Token: SeBackupPrivilege 3168 msiexec.exe Token: SeRestorePrivilege 3168 msiexec.exe Token: SeShutdownPrivilege 3168 msiexec.exe Token: SeDebugPrivilege 3168 msiexec.exe Token: SeAuditPrivilege 3168 msiexec.exe Token: SeSystemEnvironmentPrivilege 3168 msiexec.exe Token: SeChangeNotifyPrivilege 3168 msiexec.exe Token: SeRemoteShutdownPrivilege 3168 msiexec.exe Token: SeUndockPrivilege 3168 msiexec.exe Token: SeSyncAgentPrivilege 3168 msiexec.exe Token: SeEnableDelegationPrivilege 3168 msiexec.exe Token: SeManageVolumePrivilege 3168 msiexec.exe Token: SeImpersonatePrivilege 3168 msiexec.exe Token: SeCreateGlobalPrivilege 3168 msiexec.exe Token: SeCreateTokenPrivilege 3168 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3168 msiexec.exe Token: SeLockMemoryPrivilege 3168 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3168 msiexec.exe 3168 msiexec.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 5124 wrote to memory of 5048 5124 msiexec.exe 84 PID 5124 wrote to memory of 5048 5124 msiexec.exe 84 PID 5124 wrote to memory of 5048 5124 msiexec.exe 84 PID 5124 wrote to memory of 4216 5124 msiexec.exe 95 PID 5124 wrote to memory of 4216 5124 msiexec.exe 95 PID 5124 wrote to memory of 3312 5124 msiexec.exe 97 PID 5124 wrote to memory of 3312 5124 msiexec.exe 97 PID 5124 wrote to memory of 3312 5124 msiexec.exe 97 PID 5124 wrote to memory of 3496 5124 msiexec.exe 98 PID 5124 wrote to memory of 3496 5124 msiexec.exe 98 PID 5124 wrote to memory of 3496 5124 msiexec.exe 98 PID 3780 wrote to memory of 2052 3780 rundll32.exe 100 PID 3780 wrote to memory of 2052 3780 rundll32.exe 100 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4dbb76374e57bb0aeda7f060d7b49fd1c0bba480ab1527dfa0ea009db0383298.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3168
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5124 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 283B2B7529CC437FA5422FF1B1EA23DB C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5048
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4216
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A4C12CBAA967567AB762C4361BF2980E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3312
-
-
C:\Windows\Installer\MSI4796.tmp"C:\Windows\Installer\MSI4796.tmp" /DontWait C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Roaming\nvidia.dll, AnselEnableCheck2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3496
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:4700
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\nvidia.dll, AnselEnableCheck1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\System32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_8e7a47d6.dll", AnselEnableCheck2⤵
- Loads dropped DLL
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58462d.rbs
- Size 1KB
- SHA256 f93ecccb2e893341c497217a68f3a35e5cdff094bc766e998a16884dab9a3f8b
- MD5 46adac1a3cae971c9e25aab043bff192
- SHA1 d1de3aaf2c8724ee54ef8d27ef3ca39510cb8ef9
- SHA512 41b4432f154d4dfcabe088bd6af6380da86a340ebbf515d141ae08bcdbacd38e70816ea7185896e305e8ce2c4a5a727e54913d698d8a33c0898dbe232e77b3d5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\MSIF3D.tmp
- Size 436KB
- SHA256 426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
- MD5 475d20c0ea477a35660e3f67ecf0a1df
- SHA1 67340739f51e1134ae8f0ffc5ae9dd710e8e3a08
- SHA512 99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
- SSDEEP 6144:5x0A4eCDsgvSd7ftYx5fnLHT7ybjfgaUFfQiAOuv2IaZeB+:5x0ECIgYOx5fnL/tYi8OBZr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\nvidia.dll
- Size 701KB
- SHA256 1db686635bcdde30163e1e624c4d8f107fd2a20507690151c69cc6a0c482207a
- MD5 8703a1209bd5be3e9c15eb4e5db332de
- SHA1 0e110df37f6315f3a76b12714afcc55323563388
- SHA512 2dbd2753264091580055bbbcde0c6de15c3eaa593f1c1eabf0d65cc886298149798dde80259058090b2bbb446dfab27589d90fe3f92411721d90c81c9234b9c4
- SSDEEP 12288:MxoevQe9z3gFRpto9dqdUbkXlBWMbM9q2xsEX9Tmo8w7jkPpzGL8SCU2o3Fa52xg:Mx1vQeaLzGL8SCdYnW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Installer\MSI4796.tmp
- Size 389KB
- SHA256 1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
- MD5 b9545ed17695a32face8c3408a6a3553
- SHA1 f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
- SHA512 f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
- SSDEEP 6144:gMvZx0Flyv/UB8zBQSnuJnO6n4ZSaHwLvFnNLqrFWeyp1uBxfAOT3VDqO1:gMvZx0FlS68zBQSncb4ZPQTpAjZxqO1
- MD5 SHA1 SHA512 SSDEEP
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 23.7MB
- SHA256 8d6c6330ebf9e530141ea6870b065e573a8b95b833641cdd274079d2cc5a0886
- MD5 d90ea912505772210e4b883417fb1082
- SHA1 e089a766ebc7ce5496b5b44fccd84a92188e28c6
- SHA512 a666350371b5c9c3a879cf760fb6214cd02417da9aeecbb92758a92497fcc27b89280bb3d37893ec5be08662b5ab0b833252c63e7da26717f6cff43c35bf498c
- SSDEEP 24576:ESqm41CudoO/vvTL0QwOHnGgjzfpSAhKEDAtp7wmq2KsBDMm4x1/LKwFn:I
- MD5 SHA1 SHA512 SSDEEP
- Path \??\Volume{f930bed6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{2044f687-f419-4a84-9cfb-f2ed14b7f1e0}_OnDiskSnapshotProp
- Size 6KB
- SHA256 f4b57267eaa45ec106e890fe886b37cc5f4a7df26489cc7f910b2722751ea72e
- MD5 1407a3bcfdec415eea1e50254af1ac1f
- SHA1 ce9a87a0762865206dacc1336a0a709b7c7770fc
- SHA512 cc77918a46536f1068674f618c18a55c60181eb139a20285ca672a029c99145b3814a2c2f5a2bf767aecd77d9edfd201648dfaf2b973f1ec46bb8bf7571b432d
- SSDEEP 96:F1L5+2I74nDD84LTHzbOHXOHBlBRQs8Sc9XE56tOSVQpu:rtFIUb++lVm
- MD5 SHA1 SHA512 SSDEEP