Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-10-2024 01:55
Static task
static1
Behavioral task
behavioral1
Sample
989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe
Resource
win10v2004-20241007-en
General
-
Target
989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe
-
Size
11.0MB
-
MD5
262d733731abd4b67a97b682bfc9861f
-
SHA1
254734707cfd4f34388e0b907240c26732434c99
-
SHA256
989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126
-
SHA512
ec49736c73700a2eeeac0c048e1999a081ea2537564ef2e57a04d4a9bbe9016a511955ca78806c6fa18649b4abed790c35c00ed3db7296a2145590fe201c51bc
-
SSDEEP
196608:R/6pQnU/4/OVGeiU1W0vAd607M+9iX6HL7iir9ZyYJ43I/hrI:R/gQqrVGo4Ep6iXo7GYJftI
Malware Config
Extracted
latrodectus
https://restoreviner.com/test/
https://peronikilinfer.com/test/
Signatures
-
Detects Latrodectus 1 IoCs
Detects Latrodectus v1.4.
resource yara_rule behavioral1/memory/2420-8-0x000000013FCA0000-0x000000013FCB5000-memory.dmp family_latrodectus_1_4 -
Latrodectus loader
Latrodectus is a loader written in C++.
-
Deletes itself 1 IoCs
pid Process 2420 989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe -
Executes dropped EXE 1 IoCs
pid Process 2756 Update_97356924.exe -
Loads dropped DLL 2 IoCs
pid Process 2420 989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe 2420 989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2420 989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2756 2420 989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe 30 PID 2420 wrote to memory of 2756 2420 989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe 30 PID 2420 wrote to memory of 2756 2420 989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe 30 PID 2420 wrote to memory of 2688 2420 989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe 31 PID 2420 wrote to memory of 2688 2420 989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe 31 PID 2420 wrote to memory of 2688 2420 989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe 31 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe"C:\Users\Admin\AppData\Local\Temp\989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126.exe"1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Roaming\Custom_update\Update_97356924.exe"C:\Users\Admin\AppData\Roaming\Custom_update\Update_97356924.exe"2⤵
- Executes dropped EXE
PID:2756
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2420 -s 3042⤵PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.0MB
MD5262d733731abd4b67a97b682bfc9861f
SHA1254734707cfd4f34388e0b907240c26732434c99
SHA256989f811ac3c4ba5413fef99154ba60d930835d17832d6c26e3b66d9d45e01126
SHA512ec49736c73700a2eeeac0c048e1999a081ea2537564ef2e57a04d4a9bbe9016a511955ca78806c6fa18649b4abed790c35c00ed3db7296a2145590fe201c51bc