Resubmissions
30-11-2024 00:13
241130-ahvwystmfv 1029-11-2024 21:13
241129-z2qtsa1lhn 1027-11-2024 19:30
241127-x7tfratjar 1027-11-2024 19:27
241127-x6eafawrbz 1026-11-2024 23:43
241126-3qkp6sslfn 10Analysis
-
max time kernel
1794s -
max time network
1800s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 00:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
sqx.dll
Resource
win7-20240903-en
windows7-x64
12 signatures
1800 seconds
Behavioral task
behavioral2
Sample
sqx.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
10 signatures
1800 seconds
General
-
Target
sqx.dll
-
Size
1.3MB
-
MD5
dd862590d9e4ea1791df147912ae4c8f
-
SHA1
852d7a9ea4db5ff4cd51a92447a8d5701cfb322b
-
SHA256
14ffcbbfb305287ea15264df3363567f36a26917ae2018af0f40e2009b8a7184
-
SHA512
3e9222d8bd91d3e53f5e378318a78a7c5aa12011272031f7c0d8c36c5b255db1d0a168cc02e1159eb021dd18206352dd6dcb857fefc2222937c467350dc6d568
-
SSDEEP
24576:pQrDp6J8JM3IgVvF7EtPCo1Frk5fRJhqYEjTvpAbHT0HRZonw4by:pQpI8JM3IwEtPCo1F45fvhq/jTyb4HR+
Score
10/10
Malware Config
Extracted
Family
latrodectus
C2
https://reateberam.com/test/
https://dogirafer.com/test/
Signatures
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 1 IoCs
resource yara_rule behavioral2/memory/4752-0-0x000001A3C0700000-0x000001A3C073E000-memory.dmp family_bruteratel -
Detects Latrodectus 3 IoCs
Detects Latrodectus v1.4.
resource yara_rule behavioral2/memory/4752-20-0x00007FF4724B0000-0x00007FF4724C5000-memory.dmp family_latrodectus_1_4 behavioral2/memory/3456-25-0x0000000002500000-0x0000000002515000-memory.dmp family_latrodectus_1_4 behavioral2/memory/3456-26-0x0000000002500000-0x0000000002515000-memory.dmp family_latrodectus_1_4 -
Latrodectus family
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Blocklisted process makes network request 45 IoCs
flow pid Process 16 4752 rundll32.exe 18 4752 rundll32.exe 20 4752 rundll32.exe 25 4752 rundll32.exe 47 4752 rundll32.exe 55 4752 rundll32.exe 56 4752 rundll32.exe 57 4752 rundll32.exe 64 4752 rundll32.exe 65 4752 rundll32.exe 70 4752 rundll32.exe 71 4752 rundll32.exe 73 4752 rundll32.exe 74 4752 rundll32.exe 75 4752 rundll32.exe 76 4752 rundll32.exe 77 4752 rundll32.exe 80 4752 rundll32.exe 81 4752 rundll32.exe 82 4752 rundll32.exe 83 4752 rundll32.exe 84 4752 rundll32.exe 85 4752 rundll32.exe 86 4752 rundll32.exe 87 4752 rundll32.exe 88 4752 rundll32.exe 89 4752 rundll32.exe 90 4752 rundll32.exe 93 4752 rundll32.exe 94 4752 rundll32.exe 95 4752 rundll32.exe 96 4752 rundll32.exe 97 4752 rundll32.exe 98 4752 rundll32.exe 99 4752 rundll32.exe 100 4752 rundll32.exe 101 4752 rundll32.exe 102 4752 rundll32.exe 103 4752 rundll32.exe 104 4752 rundll32.exe 105 4752 rundll32.exe 106 4752 rundll32.exe 107 4752 rundll32.exe 110 4752 rundll32.exe 111 4752 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe 4752 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE -
Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4752 wrote to memory of 3456 4752 rundll32.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3456 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\sqx.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4752
-