Analysis
- max time kernel
1181s - max time network
1142s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
26/09/2024, 03:09
General
- Target Run-Malware-1.bat
- Size 23B
- Sample240926-dnj87atgnk
- SHA256 abed1ef122ea30ebb41172a1e28688e4948b528f4a47909681bc7f54dd3cc17f
Score
10/10
Malware Config
Signatures
- Detects Latrodectus 6 IoCs
Detects Latrodectus v1.4.
- Latrodectus loader
Latrodectus is a loader written in C++.
- Blocklisted process makes network request 4 IoCs
- Loads dropped DLL 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Run-Malware-1.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe vim.dll,#42⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_78aa1985.dll", #43⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_78aa1985.dll", #41⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_78aa1985.dll", #41⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Update_78aa1985.dll
memory/880-8-0x0000012011AA0000-0x0000012011AB6000-memory.dmp
memory/880-9-0x0000012011AA0000-0x0000012011AB6000-memory.dmp
memory/2324-0-0x00000251B7890000-0x00000251B78A6000-memory.dmp
memory/2324-1-0x00000251B7890000-0x00000251B78A6000-memory.dmp
memory/2324-2-0x00000251B7890000-0x00000251B78A6000-memory.dmp
memory/2324-4-0x0000000180000000-0x0000000180182000-memory.dmp
memory/2324-6-0x00000251B7890000-0x00000251B78A6000-memory.dmp