Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03-10-2024 19:27

General

  • Target

    _rtl.dll

  • Size

    749KB

  • MD5

    b1ca25f5bb4edd293b3711c77eb99a6f

  • SHA1

    178bba8686ea329b884a652fe0f8a0ae0c53d367

  • SHA256

    97a6331239d451d7dfe15bfe17de8b419df741ae68bacd440808f8b8d3f99b8a

  • SHA512

    d5a282a8f81e117b79616c44a260d89c7fee06f4ac1387675bc79c3bd7599a5d49fbe3d8fb3d4d42eea81a17564abc2d42288bc2dc468d1b16ed633ba421b32d

  • SSDEEP

    12288:/h/M5nsxW5fFcrGn7Q21Svj07MGpmeSM6q4LWYv1AoMJPPyogk31OkRK1OKeQeq:/rD+JPPn8kM1Oej

Score
10/10

Malware Config

Signatures

  • Detects Latrodectus 4 IoCs

    Detects Latrodectus v1.4.

  • Latrodectus loader

    Latrodectus is a loader written in C++.

  • Blocklisted process makes network request 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:3316
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\_rtl.dll,#1
      2⤵
        PID:512
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4112
        • C:\Windows\system32\rundll32.exe
          rundll32 _rtl.dll,#5
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4276

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3316-57-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

      Filesize

      84KB

    • memory/3316-59-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

      Filesize

      84KB

    • memory/3316-58-0x0000000000AD0000-0x0000000000AE5000-memory.dmp

      Filesize

      84KB

    • memory/4276-33-0x0000017E93DD0000-0x0000017E93E1C000-memory.dmp

      Filesize

      304KB

    • memory/4276-50-0x00007FF6AF3F0000-0x00007FF6AF3F1000-memory.dmp

      Filesize

      4KB

    • memory/4276-9-0x00007FF84CAB0000-0x00007FF84CCF9000-memory.dmp

      Filesize

      2.3MB

    • memory/4276-7-0x00007FF84D860000-0x00007FF84D90E000-memory.dmp

      Filesize

      696KB

    • memory/4276-3-0x0000000273F40000-0x0000000273F8A000-memory.dmp

      Filesize

      296KB

    • memory/4276-2-0x0000000273F40000-0x0000000273F8A000-memory.dmp

      Filesize

      296KB

    • memory/4276-1-0x0000017E92380000-0x0000017E923C7000-memory.dmp

      Filesize

      284KB

    • memory/4276-0-0x0000000273F40000-0x0000000273F8A000-memory.dmp

      Filesize

      296KB

    • memory/4276-51-0x00007FF6AF3D0000-0x00007FF6AF3E5000-memory.dmp

      Filesize

      84KB

    • memory/4276-11-0x0000017E93DD0000-0x0000017E93E1C000-memory.dmp

      Filesize

      304KB

    • memory/4276-20-0x00007FF84FDF1000-0x00007FF84FEFF000-memory.dmp

      Filesize

      1.1MB

    • memory/4276-5-0x00007FF84FDF0000-0x00007FF84FFCB000-memory.dmp

      Filesize

      1.9MB

    • memory/4276-55-0x00007FF6AF390000-0x00007FF6AF391000-memory.dmp

      Filesize

      4KB

    • memory/4276-54-0x00007FF6AF3A0000-0x00007FF6AF3A1000-memory.dmp

      Filesize

      4KB

    • memory/4276-53-0x00007FF6AF3B0000-0x00007FF6AF3B1000-memory.dmp

      Filesize

      4KB

    • memory/4276-52-0x00007FF6AF3C0000-0x00007FF6AF3C1000-memory.dmp

      Filesize

      4KB

    • memory/4276-4-0x0000017E93C90000-0x0000017E93CCE000-memory.dmp

      Filesize

      248KB

    • memory/4276-62-0x0000017E93DD0000-0x0000017E93E1C000-memory.dmp

      Filesize

      304KB