Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 01:07

General

  • Target

    c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf.msi

  • Size

    2.0MB

  • MD5

    309abcad11b67d2498cf87c4e10ff30f

  • SHA1

    0d805a684b889846a7b00cecc0ee84c7cf93398d

  • SHA256

    c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf

  • SHA512

    0f0c0f4a04ae65532a7f4c197ca22c371d904a5b3055e14bd537a3c092d8b4526a597564019395ed0b05d4ffbc6d9b450a8d267de3906f88ac2d320f9c75bdd9

  • SSDEEP

    49152:ecS3YhW8zBQSc0ZnSKBZKumZr7AQkojSo0kzI8ZVE6VPbe:sYY0Zn3K/AQz3Tbx56

Malware Config

Extracted

Family

latrodectus

C2

https://bestmarsgood.com/test/

https://cerwintifed.com/test/

Signatures

  • Detects Latrodectus 3 IoCs

    Detects Latrodectus v1.4.

  • Latrodectus family
  • Latrodectus loader

    Latrodectus is a loader written in C++.

  • Blocklisted process makes network request 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 13 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 43 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1248
      • C:\Windows\system32\msiexec.exe
        msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf.msi
        2⤵
        • Enumerates connected drives
        • Event Triggered Execution: Installer Packages
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2860
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2016
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2500
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding F8B21B244D42ADC2A8571756B786D024
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2104
      • C:\Windows\Installer\MSIEA73.tmp
        "C:\Windows\Installer\MSIEA73.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1864
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2316
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000320" "00000000000005D0"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2888

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\f76e6bb.rbs

      Filesize

      1KB

      MD5

      807346ce0766d4da1ea70bc80d18e032

      SHA1

      c601d316da506b76aa5a60a3b7a65e500e248853

      SHA256

      247e14dcbc260ae379c7b884a2bd9745543797e3b9068462156b798b315a8e41

      SHA512

      23acaf4d47868439c3c1c33f89aa57e846f6809c0f7a087c60c38619ce821ec458243566bbffaa1cddbae9e0e82b2e541579c402eb019dd27f67cf7650142102

    • C:\Users\Admin\AppData\Roaming\sqx.dll

      Filesize

      1.3MB

      MD5

      dd862590d9e4ea1791df147912ae4c8f

      SHA1

      852d7a9ea4db5ff4cd51a92447a8d5701cfb322b

      SHA256

      14ffcbbfb305287ea15264df3363567f36a26917ae2018af0f40e2009b8a7184

      SHA512

      3e9222d8bd91d3e53f5e378318a78a7c5aa12011272031f7c0d8c36c5b255db1d0a168cc02e1159eb021dd18206352dd6dcb857fefc2222937c467350dc6d568

    • C:\Windows\Installer\MSIEA73.tmp

      Filesize

      389KB

      MD5

      b9545ed17695a32face8c3408a6a3553

      SHA1

      f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

      SHA256

      1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

      SHA512

      f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

    • \Windows\Installer\MSIE705.tmp

      Filesize

      436KB

      MD5

      475d20c0ea477a35660e3f67ecf0a1df

      SHA1

      67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

      SHA256

      426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

      SHA512

      99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

    • memory/1248-78-0x0000000002DF0000-0x0000000002E05000-memory.dmp

      Filesize

      84KB

    • memory/1248-76-0x0000000002DF0000-0x0000000002E05000-memory.dmp

      Filesize

      84KB

    • memory/1248-79-0x0000000002DF0000-0x0000000002E05000-memory.dmp

      Filesize

      84KB

    • memory/1864-36-0x00000000000B0000-0x00000000000B2000-memory.dmp

      Filesize

      8KB

    • memory/2500-48-0x0000000000470000-0x00000000004BC000-memory.dmp

      Filesize

      304KB

    • memory/2500-70-0x000007FFFFF90000-0x000007FFFFF91000-memory.dmp

      Filesize

      4KB

    • memory/2500-71-0x000007FFFFF70000-0x000007FFFFF85000-memory.dmp

      Filesize

      84KB

    • memory/2500-75-0x000007FFFFF30000-0x000007FFFFF31000-memory.dmp

      Filesize

      4KB

    • memory/2500-74-0x000007FFFFF40000-0x000007FFFFF41000-memory.dmp

      Filesize

      4KB

    • memory/2500-73-0x000007FFFFF50000-0x000007FFFFF51000-memory.dmp

      Filesize

      4KB

    • memory/2500-72-0x000007FFFFF60000-0x000007FFFFF61000-memory.dmp

      Filesize

      4KB

    • memory/2500-92-0x0000000000470000-0x00000000004BC000-memory.dmp

      Filesize

      304KB