Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1194s -
max time network
1198s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/09/2024, 03:25
Behavioral task
behavioral1
Sample
UpdaterTag.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
UpdaterTag.dll
Resource
win11-20240802-en
General
-
Target
UpdaterTag.dll
-
Size
75KB
-
MD5
08071c1626889186043493cd17007d1b
-
SHA1
845f7494136882095f391075b0b0113d86380792
-
SHA256
eaf0ece0a09bb590077f6e5a7115c38b11d7a8e93e5b2a7608724cd66dc327b5
-
SHA512
80049aff6af3c6ef4f77017141381c01d15d5e00dcb62d0c3d10251798cbe73fb119b6996d7bddee526a75b06615d58281731581023e5ac42a982e1b9b5d54e4
-
SSDEEP
1536:KzhEJO+9X+cc8TAGRO73fhRPf82jhuplU:KzhEt9HTAGyk2Yp
Malware Config
Signatures
-
Detects Latrodectus 2 IoCs
Detects Latrodectus v1.4.
resource yara_rule behavioral1/files/0x00090000000234b0-1.dat family_latrodectus_1_4 behavioral1/memory/4624-2-0x00007FFD78F10000-0x00007FFD78F26000-memory.dmp family_latrodectus_1_4 -
Latrodectus loader
Latrodectus is a loader written in C++.
-
Blocklisted process makes network request 5 IoCs
flow pid Process 61 4184 rundll32.exe 64 4184 rundll32.exe 65 4184 rundll32.exe 66 4184 rundll32.exe 67 4184 rundll32.exe -
Deletes itself 1 IoCs
pid Process 4624 rundll32.exe -
Loads dropped DLL 3 IoCs
pid Process 4184 rundll32.exe 2024 rundll32.exe 3696 rundll32.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4624 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4624 wrote to memory of 4184 4624 rundll32.exe 82 PID 4624 wrote to memory of 4184 4624 rundll32.exe 82 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UpdaterTag.dll,#11⤵
- Deletes itself
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_2bc585e8.dll", #12⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:4184
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_2bc585e8.dll", #11⤵
- Loads dropped DLL
PID:2024
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_2bc585e8.dll", #11⤵
- Loads dropped DLL
PID:3696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD508071c1626889186043493cd17007d1b
SHA1845f7494136882095f391075b0b0113d86380792
SHA256eaf0ece0a09bb590077f6e5a7115c38b11d7a8e93e5b2a7608724cd66dc327b5
SHA51280049aff6af3c6ef4f77017141381c01d15d5e00dcb62d0c3d10251798cbe73fb119b6996d7bddee526a75b06615d58281731581023e5ac42a982e1b9b5d54e4