Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 06:57
Static task
static1
Behavioral task
behavioral1
Sample
d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051N.exe
Resource
win10v2004-20241007-en
General
-
Target
d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051N.exe
-
Size
2.5MB
-
MD5
187b9b21317fc31a90a5b804102e15b0
-
SHA1
c99f09128e405dd75bf218e80c048c613ef90359
-
SHA256
d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051
-
SHA512
d75fe63e440260c701fecb500e2f8f62e97207f31610d6a93b28fa0f33a0df9d80c665c1e86692933862cb1ecc4979f48aa643b0ad95aa484d6822a24bd44434
-
SSDEEP
49152:q2daHSl4E1Kn2w719v6ODWb2h7dk2YCRq7fjN8QC7a0N9esKsJIV4:P1K2Vio2h7G2YCRq7h5C7aHs7o
Malware Config
Extracted
latrodectus
https://proliforetka.com/test/
https://dogirafer.com/test/
Signatures
-
Latrodectus family
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Deletes itself 1 IoCs
pid Process 2204 d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051N.exe -
Executes dropped EXE 1 IoCs
pid Process 1984 Update_dc133309.exe -
Loads dropped DLL 1 IoCs
pid Process 2204 d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051N.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2204 d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051N.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2204 wrote to memory of 1984 2204 d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051N.exe 28 PID 2204 wrote to memory of 1984 2204 d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051N.exe 28 PID 2204 wrote to memory of 1984 2204 d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051N.exe 28 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051N.exe"C:\Users\Admin\AppData\Local\Temp\d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051N.exe"1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Roaming\Custom_update\Update_dc133309.exe"C:\Users\Admin\AppData\Roaming\Custom_update\Update_dc133309.exe"2⤵
- Executes dropped EXE
PID:1984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5187b9b21317fc31a90a5b804102e15b0
SHA1c99f09128e405dd75bf218e80c048c613ef90359
SHA256d1e47440f39aa38030291c418b411fdb89e30cf8b909069da2c3b70fb02c8051
SHA512d75fe63e440260c701fecb500e2f8f62e97207f31610d6a93b28fa0f33a0df9d80c665c1e86692933862cb1ecc4979f48aa643b0ad95aa484d6822a24bd44434