latrodectus | 94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a

General

Target

94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a.msi
Size

1.5MB
MD5

9c8696dbb48add540a75737327c537d2
SHA1

78b4eb7d363e017eb06e03408d7952bbb843f9a9
SHA256

94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a
SHA512

6ee26ecedd0386eca113e61086f6623b36ca093d24e41d90cf45412072d94d91dddb39c86ce726c3514da3d0221d3cf03455b00cc5d0987ca63d45c12225cf4a
SSDEEP

49152:yErvYpW8zBQSc0ZnSKeZKumZr7Amyq3TGtezO:RYQ0ZncK/AEs

Score

10^/10

latrodectus discovery loader persistence privilege_escalation

Malware Config

Extracted

Family

latrodectus

C2

https://fluraresto.me/live/

https://mastralakkot.live/live/

Signatures

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Detect larodectus Loader variant 1 4 IoCs

loader

Processes:

resource	yara_rule
behavioral2/memory/2784-63-0x00000236B7F10000-0x00000236B7F24000-memory.dmp	family_latrodectus_v1
behavioral2/memory/2784-66-0x00000236B7F30000-0x00000236B7F43000-memory.dmp	family_latrodectus_v1
behavioral2/memory/400-75-0x000001F647A20000-0x000001F647A33000-memory.dmp	family_latrodectus_v1
behavioral2/memory/400-76-0x000001F647A20000-0x000001F647A33000-memory.dmp	family_latrodectus_v1

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIAE32.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAFD9.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e57add4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF2D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{875666CF-F53F-4ED6-B062-37C9D770DE93}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB057.tmp	msiexec.exe
File created	C:\Windows\Installer\e57add4.msi	msiexec.exe

Executes dropped EXE 1 IoCs

Processes:

MSIB057.tmp

pid process

3824 MSIB057.tmp

pid	process
3824	MSIB057.tmp

Loads dropped DLL 10 IoCs

Processes:

MsiExec.exeMsiExec.exerundll32.exerundll32.exe

pid	process
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
1828	MsiExec.exe
3944	MsiExec.exe
3944	MsiExec.exe
2784	rundll32.exe
400	rundll32.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
persistence privilege_escalation

Installer Packages
T1546.016

Msiexec
T1218.007

Processes:

msiexec.exe

pid process

2780 msiexec.exe

pid	process
2780	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MsiExec.exeMsiExec.exeMSIB057.tmp

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIB057.tmp

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e6cf55ff94a5976e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e6cf55ff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e6cf55ff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de6cf55ff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e6cf55ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msiexec.exerundll32.exerundll32.exe

pid	process
3632	msiexec.exe
3632	msiexec.exe
2784	rundll32.exe
2784	rundll32.exe
2784	rundll32.exe
2784	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe
400	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2780	msiexec.exe
Token: SeSecurityPrivilege	3632	msiexec.exe
Token: SeCreateTokenPrivilege	2780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2780	msiexec.exe
Token: SeLockMemoryPrivilege	2780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2780	msiexec.exe
Token: SeMachineAccountPrivilege	2780	msiexec.exe
Token: SeTcbPrivilege	2780	msiexec.exe
Token: SeSecurityPrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeLoadDriverPrivilege	2780	msiexec.exe
Token: SeSystemProfilePrivilege	2780	msiexec.exe
Token: SeSystemtimePrivilege	2780	msiexec.exe
Token: SeProfSingleProcessPrivilege	2780	msiexec.exe
Token: SeIncBasePriorityPrivilege	2780	msiexec.exe
Token: SeCreatePagefilePrivilege	2780	msiexec.exe
Token: SeCreatePermanentPrivilege	2780	msiexec.exe
Token: SeBackupPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeShutdownPrivilege	2780	msiexec.exe
Token: SeDebugPrivilege	2780	msiexec.exe
Token: SeAuditPrivilege	2780	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2780	msiexec.exe
Token: SeChangeNotifyPrivilege	2780	msiexec.exe
Token: SeRemoteShutdownPrivilege	2780	msiexec.exe
Token: SeUndockPrivilege	2780	msiexec.exe
Token: SeSyncAgentPrivilege	2780	msiexec.exe
Token: SeEnableDelegationPrivilege	2780	msiexec.exe
Token: SeManageVolumePrivilege	2780	msiexec.exe
Token: SeImpersonatePrivilege	2780	msiexec.exe
Token: SeCreateGlobalPrivilege	2780	msiexec.exe
Token: SeCreateTokenPrivilege	2780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2780	msiexec.exe
Token: SeLockMemoryPrivilege	2780	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2780	msiexec.exe
Token: SeMachineAccountPrivilege	2780	msiexec.exe
Token: SeTcbPrivilege	2780	msiexec.exe
Token: SeSecurityPrivilege	2780	msiexec.exe
Token: SeTakeOwnershipPrivilege	2780	msiexec.exe
Token: SeLoadDriverPrivilege	2780	msiexec.exe
Token: SeSystemProfilePrivilege	2780	msiexec.exe
Token: SeSystemtimePrivilege	2780	msiexec.exe
Token: SeProfSingleProcessPrivilege	2780	msiexec.exe
Token: SeIncBasePriorityPrivilege	2780	msiexec.exe
Token: SeCreatePagefilePrivilege	2780	msiexec.exe
Token: SeCreatePermanentPrivilege	2780	msiexec.exe
Token: SeBackupPrivilege	2780	msiexec.exe
Token: SeRestorePrivilege	2780	msiexec.exe
Token: SeShutdownPrivilege	2780	msiexec.exe
Token: SeDebugPrivilege	2780	msiexec.exe
Token: SeAuditPrivilege	2780	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2780	msiexec.exe
Token: SeChangeNotifyPrivilege	2780	msiexec.exe
Token: SeRemoteShutdownPrivilege	2780	msiexec.exe
Token: SeUndockPrivilege	2780	msiexec.exe
Token: SeSyncAgentPrivilege	2780	msiexec.exe
Token: SeEnableDelegationPrivilege	2780	msiexec.exe
Token: SeManageVolumePrivilege	2780	msiexec.exe
Token: SeImpersonatePrivilege	2780	msiexec.exe
Token: SeCreateGlobalPrivilege	2780	msiexec.exe
Token: SeCreateTokenPrivilege	2780	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2780	msiexec.exe
Token: SeLockMemoryPrivilege	2780	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

2780 msiexec.exe
2780 msiexec.exe

pid	process
2780	msiexec.exe
2780	msiexec.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

msiexec.exerundll32.exe

description	pid	process	target process
PID 3632 wrote to memory of 1828	3632	msiexec.exe	MsiExec.exe
PID 3632 wrote to memory of 1828	3632	msiexec.exe	MsiExec.exe
PID 3632 wrote to memory of 1828	3632	msiexec.exe	MsiExec.exe
PID 3632 wrote to memory of 4340	3632	msiexec.exe	srtasks.exe
PID 3632 wrote to memory of 4340	3632	msiexec.exe	srtasks.exe
PID 3632 wrote to memory of 3944	3632	msiexec.exe	MsiExec.exe
PID 3632 wrote to memory of 3944	3632	msiexec.exe	MsiExec.exe
PID 3632 wrote to memory of 3944	3632	msiexec.exe	MsiExec.exe
PID 3632 wrote to memory of 3824	3632	msiexec.exe	MSIB057.tmp
PID 3632 wrote to memory of 3824	3632	msiexec.exe	MSIB057.tmp
PID 3632 wrote to memory of 3824	3632	msiexec.exe	MSIB057.tmp
PID 2784 wrote to memory of 400	2784	rundll32.exe	rundll32.exe
PID 2784 wrote to memory of 400	2784	rundll32.exe	rundll32.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\94b8ab735d503884585fdb5a735b3ea3485b6b19c1899939a5b2c0a80616400a.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2780

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AE6D9E1A3A6F908DF007EB2811AC3B38 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1828
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FCF7A1072B095FA8AF4A992ECA00E633
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3944
- C:\Windows\Installer\MSIB057.tmp
  "C:\Windows\Installer\MSIB057.tmp" /DontWait C:/Windows/System32/rundll32.exe C:\Users\Admin\AppData\Local\Putty/setordinal.dll,bhuf
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:212

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Putty/setordinal.dll,bhuf
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\System32\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_e12aef0e.dll", bhuf
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Privilege Escalation

Event Triggered Execution

1

T1546

Installer Packages

1

T1546.016

Defense Evasion

System Binary Proxy Execution

1

T1218

Msiexec

1

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e57add5.rbs

Filesize
1KB

MD5
d615ccb521a870bd055eade411e3554a

SHA1
5bcf522a1d4145e1724139bb812fdaf332d4136c

SHA256
a91dc851ea3628433815fc5d4e00aebffb8ebbae9ba64c8d16195e630dbfc95e

SHA512
e6d5c7152b394bc47704e539b5551060259ac1b428f866bcf1cede4e8f19790ccf690356a2f48cfc9409497bb1a9c7f3e39ae024517ec953e4b6811a5ead4632

Download Submit
C:\Users\Admin\AppData\Local\Putty\setordinal.dll

Filesize
809KB

MD5
4b8ecaac3e8a17382932e3daa29dc688

SHA1
3ed854b6fda284fdad105cb158949edd9276cd67

SHA256
61925bfd71b4d2be670b0bd373b33645d6af062e5d41cb2b6f6c984acbd69de3

SHA512
de0459c85786c97ff1b5b0051139fb30fb56cfba45b56384adf8d813faadda0fde80fe9c5fb99aba356d8f0e43f61a8b1bdc232cf12d5f3ba4c99403d9c7a8e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI7772.tmp

Filesize
436KB

MD5
475d20c0ea477a35660e3f67ecf0a1df

SHA1
67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

SHA256
426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

SHA512
99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

Download Submit
C:\Windows\Installer\MSIB057.tmp

Filesize
389KB

MD5
b9545ed17695a32face8c3408a6a3553

SHA1
f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

SHA256
1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

SHA512
f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
4729277051b85c61700e32b0b5e04b35

SHA1
f64098589d0d794262c962591a03c6c23d665cce

SHA256
f18b64f128153fe807879fb2f738ea8a1ca2c7ea69caeb147af6d57b96e91881

SHA512
220563ce339803e7cd01b81cfe3d7dcdd8899262f3cc5411b6e582962b9dfe1c4a18293f3284f25bb7355e0dc40440bb1db4f90af7b4b4b49703973125962906

Download Submit
\??\Volume{ff55cfe6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cafd117b-570c-4853-90cc-df8adfe5ee71}_OnDiskSnapshotProp

Filesize
6KB

MD5
63272ac243b8cdcc1d2a68adaafc57d0

SHA1
b80e3c1e36d43d648e3cb52f7fb6c7c320f158a5

SHA256
8b6537dbe7d60a9d093be7280db72dd0aed3151caedbcdd37efee6f75e789a85

SHA512
4a1b0d2e6edc5e8e73477b6535f01b05adaac3fe388981054c2c69b7ada2cd9cb7ff92ecf7e2c542b46847a4de45c7f156cb9ceddc4fb4c064fda8e58267357e

Download Submit
memory/400-75-0x000001F647A20000-0x000001F647A33000-memory.dmp

Filesize
76KB

Download
memory/400-76-0x000001F647A20000-0x000001F647A33000-memory.dmp

Filesize
76KB

Download
memory/2784-63-0x00000236B7F10000-0x00000236B7F24000-memory.dmp

Filesize
80KB

Download
memory/2784-66-0x00000236B7F30000-0x00000236B7F43000-memory.dmp

Filesize
76KB

Download
memory/2784-68-0x0000000180000000-0x00000001800D0000-memory.dmp

Filesize
832KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads