Analysis

  • max time kernel
    147s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 01:07

General

  • Target

    c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf.msi

  • Size

    2.0MB

  • MD5

    309abcad11b67d2498cf87c4e10ff30f

  • SHA1

    0d805a684b889846a7b00cecc0ee84c7cf93398d

  • SHA256

    c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf

  • SHA512

    0f0c0f4a04ae65532a7f4c197ca22c371d904a5b3055e14bd537a3c092d8b4526a597564019395ed0b05d4ffbc6d9b450a8d267de3906f88ac2d320f9c75bdd9

  • SSDEEP

    49152:ecS3YhW8zBQSc0ZnSKBZKumZr7AQkojSo0kzI8ZVE6VPbe:sYY0Zn3K/AQz3Tbx56

Malware Config

Extracted

Family

latrodectus

C2

https://bestmarsgood.com/test/

https://cerwintifed.com/test/

Signatures

  • Detects Latrodectus 3 IoCs

    Detects Latrodectus v1.4.

  • Latrodectus family
  • Latrodectus loader

    Latrodectus is a loader written in C++.

  • Blocklisted process makes network request 6 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 12 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 63 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3520
      • C:\Windows\system32\msiexec.exe
        msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\c39abdca1a31b20fe06969a36102c784df7f63847ec930dfaf8c4bd97b4558bf.msi
        2⤵
        • Enumerates connected drives
        • Event Triggered Execution: Installer Packages
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2008
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\SysWOW64\rundll32.exe" C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2688
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3148
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding A025941A42A46760AFA7478B9775ECF8
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1588
      • C:\Windows\Installer\MSI1359.tmp
        "C:\Windows\Installer\MSI1359.tmp" /DontWait C:/Windows/SysWOW64/rundll32.exe C:\Users\Admin\AppData\Roaming\sqx.dll, GetDbInterface
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1288
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1480

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e580f31.rbs

      Filesize

      1KB

      MD5

      68850b1319516f99da7e7cd935d9efbe

      SHA1

      5e59af9d7d5af6534a54ee23f9984d91be271a3c

      SHA256

      e7d8468929e7c93f0cfee769ddd2b58680c6d2809f8e5e3c265a27911ea4af71

      SHA512

      da169a2ba1fa8ed7a90f296389e086af4b16d5585c6281783381e57b417fd219d42295f3fc7d443434ccf5137ef9465497ccd1cbace0024f37c39aa7c1315d4a

    • C:\Users\Admin\AppData\Roaming\sqx.dll

      Filesize

      1.3MB

      MD5

      dd862590d9e4ea1791df147912ae4c8f

      SHA1

      852d7a9ea4db5ff4cd51a92447a8d5701cfb322b

      SHA256

      14ffcbbfb305287ea15264df3363567f36a26917ae2018af0f40e2009b8a7184

      SHA512

      3e9222d8bd91d3e53f5e378318a78a7c5aa12011272031f7c0d8c36c5b255db1d0a168cc02e1159eb021dd18206352dd6dcb857fefc2222937c467350dc6d568

    • C:\Windows\Installer\MSI1359.tmp

      Filesize

      389KB

      MD5

      b9545ed17695a32face8c3408a6a3553

      SHA1

      f6c31c9cd832ae2aebcd88e7b2fa6803ae93fc83

      SHA256

      1e0e63b446eecf6c9781c7d1cae1f46a3bb31654a70612f71f31538fb4f4729a

      SHA512

      f6d6dc40dcba5ff091452d7cc257427dcb7ce2a21816b4fec2ee249e63246b64667f5c4095220623533243103876433ef8c12c9b612c0e95fdfffe41d1504e04

    • C:\Windows\Installer\MSIF7C.tmp

      Filesize

      436KB

      MD5

      475d20c0ea477a35660e3f67ecf0a1df

      SHA1

      67340739f51e1134ae8f0ffc5ae9dd710e8e3a08

      SHA256

      426e6cf199a8268e8a7763ec3a4dd7add982b28c51d89ebea90ca792cbae14dd

      SHA512

      99525aaab2ab608134b5d66b5313e7fc3c2e2877395c5c171897d7a6c66efb26b606de1a4cb01118c2738ea4b6542e4eb4983e631231b3f340bf85e509a9589e

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

      Filesize

      24.1MB

      MD5

      417a3a41f6679af07d8ec51c168e701b

      SHA1

      0d39ad1d7c5507d121b14a664155730431dc8298

      SHA256

      4944964449c955b03c4566ec36af7de37e238f2ffe0f7460e9f24dbaf49ce315

      SHA512

      49fa095ee9f376e0a55a8d4bd545533f80bfd707be292004d82ae865591d280262db7463c36fee23c3acab12f69edce8013fa45bf27e28a4ba71373f5d4ac58e

    • \??\Volume{0576a638-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8074ad89-5c5d-4898-883e-eebbaaea2347}_OnDiskSnapshotProp

      Filesize

      6KB

      MD5

      e9243c70562b9e2cb7f4c6861c74624b

      SHA1

      9cf157e164de1041973652c9c0ca9feaa0da1074

      SHA256

      05a144a2804416585b36c0cb8ae94e25cb2ea9096ad3a66e64c261b6b51f638d

      SHA512

      40e321cf7bdd8ade590af7d526ffc6829a53d6e7347aa8a4ba7a159c623534aa4faaae77d779b3b059bdbd9538963cdc3e8b06831713f61d3ad0d5b142b132fc

    • memory/2688-65-0x00007FF47A480000-0x00007FF47A481000-memory.dmp

      Filesize

      4KB

    • memory/2688-63-0x00007FF47A4A0000-0x00007FF47A4A1000-memory.dmp

      Filesize

      4KB

    • memory/2688-64-0x00007FF47A490000-0x00007FF47A491000-memory.dmp

      Filesize

      4KB

    • memory/2688-62-0x00007FF47A4B0000-0x00007FF47A4B1000-memory.dmp

      Filesize

      4KB

    • memory/2688-60-0x00007FF47A4E0000-0x00007FF47A4E1000-memory.dmp

      Filesize

      4KB

    • memory/2688-61-0x00007FF47A4C0000-0x00007FF47A4D5000-memory.dmp

      Filesize

      84KB

    • memory/2688-45-0x00000210923F0000-0x000002109243C000-memory.dmp

      Filesize

      304KB

    • memory/2688-75-0x00000210923F0000-0x000002109243C000-memory.dmp

      Filesize

      304KB

    • memory/3520-66-0x00000000022F0000-0x0000000002305000-memory.dmp

      Filesize

      84KB

    • memory/3520-67-0x00000000022F0000-0x0000000002305000-memory.dmp

      Filesize

      84KB