Resubmissions
30/11/2024, 00:13
241130-ahvwystmfv1029/11/2024, 21:13
241129-z2qtsa1lhn1027/11/2024, 19:30
241127-x7tfratjar1027/11/2024, 19:27
241127-x6eafawrbz1026/11/2024, 23:43
241126-3qkp6sslfn10Analysis
- max time kernel
30s - max time network
14s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
26/11/2024, 23:43
General
- Target sqx.dll
- Size 1.3MB
- Sample241126-3qkp6sslfn
- SHA256 14ffcbbfb305287ea15264df3363567f36a26917ae2018af0f40e2009b8a7184
Malware Config
Extracted
-
latrodectus
-
https://reateberam.com/test/
-
https://dogirafer.com/test/
Signatures
- Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
- Bruteratel family
- Detect BruteRatel badger 1 IoCs
- Detects Latrodectus 3 IoCs
Detects Latrodectus v1.4.
- Latrodectus family
- Latrodectus loader
Latrodectus is a loader written in C++.
- Blocklisted process makes network request 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sqx.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3396-22-0x0000000000A00000-0x0000000000A15000-memory.dmp
memory/3396-23-0x0000000000A00000-0x0000000000A15000-memory.dmp
memory/4832-0-0x0000028BDB1F0000-0x0000028BDB23C000-memory.dmp
memory/4832-9-0x0000028BDB080000-0x0000028BDB0BE000-memory.dmp
memory/4832-17-0x00007FF483290000-0x00007FF4832A5000-memory.dmp
memory/4832-19-0x00007FF483270000-0x00007FF483271000-memory.dmp
memory/4832-21-0x00007FF483250000-0x00007FF483251000-memory.dmp
memory/4832-20-0x00007FF483260000-0x00007FF483261000-memory.dmp
memory/4832-18-0x00007FF483280000-0x00007FF483281000-memory.dmp
memory/4832-16-0x00007FF4832B0000-0x00007FF4832B1000-memory.dmp