Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 17:19
Static task
static1
Behavioral task
behavioral1
Sample
medk.msi
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
medk.msi
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
medk.msi
-
Size
2.0MB
-
MD5
8cb04bf931a19fa0ae1bd7235180dd4a
-
SHA1
dfc980a827dbde294ae9fa6e63545d1d57344e96
-
SHA256
dfff1a07429ff9585f3dab9c78b501174e7c326e1fb95c5234368071b5426768
-
SHA512
58f1661d689aaa9391f04e086db490693f83b70e068ca10b20cff6f87979a8804aa9f054ac961af06c4b7b17fd88b1912774b2eb3d16b9df8e7a4ed9bb3c0a29
-
SSDEEP
49152:F943YhW8zBQSc0ZnSKBZKumZr7Apj3Y+7jHplNa:6YY0Zn3K/Al3dXHpra
Malware Config
Extracted
Family
latrodectus
C2
https://rolefenik.com/test/
https://ergiholim.com/test/
Signatures
-
Detects Latrodectus 3 IoCs
Detects Latrodectus v1.4.
resource yara_rule behavioral2/memory/5000-63-0x00007FF438980000-0x00007FF438995000-memory.dmp family_latrodectus_1_4 behavioral2/memory/3488-68-0x0000000002860000-0x0000000002875000-memory.dmp family_latrodectus_1_4 behavioral2/memory/3488-69-0x0000000002860000-0x0000000002875000-memory.dmp family_latrodectus_1_4 -
Latrodectus family
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Blocklisted process makes network request 8 IoCs
flow pid Process 28 5000 rundll32.exe 30 5000 rundll32.exe 33 5000 rundll32.exe 36 5000 rundll32.exe 53 5000 rundll32.exe 59 5000 rundll32.exe 61 5000 rundll32.exe 64 5000 rundll32.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Installer\e57a76b.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA7B9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA8C4.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{5AB6B0C5-5CD6-4CF7-ABF4-4E467A0D78CE} msiexec.exe File opened for modification C:\Windows\Installer\MSIA9FF.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIAC43.tmp msiexec.exe File created C:\Windows\Installer\e57a76b.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIA923.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA981.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Executes dropped EXE 1 IoCs
pid Process 432 MSIAC43.tmp -
Loads dropped DLL 6 IoCs
pid Process 4496 MsiExec.exe 4496 MsiExec.exe 4496 MsiExec.exe 4496 MsiExec.exe 384 rundll32.exe 5000 rundll32.exe -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 2460 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIAC43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000001d4141155d34ac580000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800001d4141150000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809001d414115000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d1d414115000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000001d41411500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4092 msiexec.exe 4092 msiexec.exe 5000 rundll32.exe 5000 rundll32.exe 5000 rundll32.exe 5000 rundll32.exe 5000 rundll32.exe 5000 rundll32.exe 5000 rundll32.exe 5000 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeShutdownPrivilege 2460 msiexec.exe Token: SeIncreaseQuotaPrivilege 2460 msiexec.exe Token: SeSecurityPrivilege 4092 msiexec.exe Token: SeCreateTokenPrivilege 2460 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2460 msiexec.exe Token: SeLockMemoryPrivilege 2460 msiexec.exe Token: SeIncreaseQuotaPrivilege 2460 msiexec.exe Token: SeMachineAccountPrivilege 2460 msiexec.exe Token: SeTcbPrivilege 2460 msiexec.exe Token: SeSecurityPrivilege 2460 msiexec.exe Token: SeTakeOwnershipPrivilege 2460 msiexec.exe Token: SeLoadDriverPrivilege 2460 msiexec.exe Token: SeSystemProfilePrivilege 2460 msiexec.exe Token: SeSystemtimePrivilege 2460 msiexec.exe Token: SeProfSingleProcessPrivilege 2460 msiexec.exe Token: SeIncBasePriorityPrivilege 2460 msiexec.exe Token: SeCreatePagefilePrivilege 2460 msiexec.exe Token: SeCreatePermanentPrivilege 2460 msiexec.exe Token: SeBackupPrivilege 2460 msiexec.exe Token: SeRestorePrivilege 2460 msiexec.exe Token: SeShutdownPrivilege 2460 msiexec.exe Token: SeDebugPrivilege 2460 msiexec.exe Token: SeAuditPrivilege 2460 msiexec.exe Token: SeSystemEnvironmentPrivilege 2460 msiexec.exe Token: SeChangeNotifyPrivilege 2460 msiexec.exe Token: SeRemoteShutdownPrivilege 2460 msiexec.exe Token: SeUndockPrivilege 2460 msiexec.exe Token: SeSyncAgentPrivilege 2460 msiexec.exe Token: SeEnableDelegationPrivilege 2460 msiexec.exe Token: SeManageVolumePrivilege 2460 msiexec.exe Token: SeImpersonatePrivilege 2460 msiexec.exe Token: SeCreateGlobalPrivilege 2460 msiexec.exe Token: SeBackupPrivilege 3816 vssvc.exe Token: SeRestorePrivilege 3816 vssvc.exe Token: SeAuditPrivilege 3816 vssvc.exe Token: SeBackupPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeBackupPrivilege 4376 srtasks.exe Token: SeRestorePrivilege 4376 srtasks.exe Token: SeSecurityPrivilege 4376 srtasks.exe Token: SeTakeOwnershipPrivilege 4376 srtasks.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeRestorePrivilege 4092 msiexec.exe Token: SeTakeOwnershipPrivilege 4092 msiexec.exe Token: SeBackupPrivilege 4376 srtasks.exe Token: SeRestorePrivilege 4376 srtasks.exe Token: SeSecurityPrivilege 4376 srtasks.exe Token: SeTakeOwnershipPrivilege 4376 srtasks.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2460 msiexec.exe 2460 msiexec.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3488 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4092 wrote to memory of 4376 4092 msiexec.exe 97 PID 4092 wrote to memory of 4376 4092 msiexec.exe 97 PID 4092 wrote to memory of 4496 4092 msiexec.exe 99 PID 4092 wrote to memory of 4496 4092 msiexec.exe 99 PID 4092 wrote to memory of 4496 4092 msiexec.exe 99 PID 4092 wrote to memory of 432 4092 msiexec.exe 102 PID 4092 wrote to memory of 432 4092 msiexec.exe 102 PID 4092 wrote to memory of 432 4092 msiexec.exe 102 PID 384 wrote to memory of 5000 384 rundll32.exe 104 PID 384 wrote to memory of 5000 384 rundll32.exe 104 PID 5000 wrote to memory of 3488 5000 rundll32.exe 56 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
PID:3488 -
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\medk.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2460
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\tab.dll, Object2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Windows\system32\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\tab.dll, Object3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5000
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 28AA28B5223B9BD06D95BBB64E3112EB2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4496
-
-
C:\Windows\Installer\MSIAC43.tmp"C:\Windows\Installer\MSIAC43.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\Admin\AppData\Roaming\tab.dll, Object2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:432
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50f8072066d82d7402094b239c5f3283b
SHA124f7913cad4302f796ed621313fa171b0595b521
SHA256ee9f5e85020c9cec0d83b4aad60556642edf846fa6e807d3ce3cf165415a58ad
SHA512b443e94046f4477ce67975c97056fd71647091a508843d7058e211b8662411f90cf4ce159c5b0582c3c73551d6119d0dbca7871c072f12e9e6f353bf70fbb18f
-
Filesize
1.6MB
MD54f4a164b5f9ef20be601531a727179a2
SHA11601622dc7caef28ce413e1d73b4d4596aabfc50
SHA2560f23855e56eb6ec760717be43280eeeeaec1aeef939f9ae6a41daf1b8e3bd306
SHA512de09d9f0048a19c7efa7ffae01f58c41e619e09e6ec56e4b818b58846672a0772c58913ba5ad4c86b746d91399894a21bf51225c1737a0652b1c85ffa3307030
-
Filesize
436KB
MD5475d20c0ea477a35660e3f67ecf0a1df
SHA167340739f51e1134ae8f0ffc5ae9dd710e8e3a08
SHA256426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd
SHA51299525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e
-
Filesize
389KB
MD5b9545ed17695a32face8c3408a6a3553
SHA1f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83
SHA2561e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a
SHA512f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04
-
Filesize
24.1MB
MD5667086549b26d9018b35d1340eb0847b
SHA11be230022d75a198a3afaf1c3b3545a03d4a199c
SHA2563040e131f6f598e44c7951aaacd4e623ddf26488df4e368016d0ec93a0c7476e
SHA51264a35573b0e7d49b68e86ed8ee75ead3fccf76f93411e39c50789b22b9999b5fc4943eb6fb26120f047979cc8264edce5ec69405d972d930202d140458469d07
-
\??\Volume{1541411d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{c4f88144-7f04-4607-bc7a-8ff1ea06b40e}_OnDiskSnapshotProp
Filesize6KB
MD5c6b1a10bda73ddaf1a08773e87b6d1b2
SHA1279d506fdc957abd829801c0d4243cf2f056d6b1
SHA256a8e29bb2fa9758300fb4631aaa026c3b15cb7adc8d0b7af7a4a44d2497e8f296
SHA5127060b7ee1974e527e087460595b5ec1c968de4302ebc71fbda6b2bd82eacbc5c9669039521d2a94011f4c37ddb7e2d57f2bfd647437153064dbcdfc7ecd7b6c6