latrodectus | 6ada7b6d8b6ddf3ebe61d3bf19e70bb5a2a9f22d871d217b1ade7c40c3aac088

General

Target

FixSfp.exe
Size

1.1MB
MD5

c4738b7ee108e1cfd0619cf740f458e0
SHA1

01c40a43bdf3bb2edfa4b9aa039439a47e9edc6d
SHA256

6ada7b6d8b6ddf3ebe61d3bf19e70bb5a2a9f22d871d217b1ade7c40c3aac088
SHA512

4c4a68739593e02c3997905ab10e7492b64f288a39211a81797cadaf2432aa90f94874e83520bbb149810e04fdc0e401eac30d10402b5c5822887f3b9cbbf2cb
SSDEEP

24576:xFdIR2uJMaFHaNfZq8gGl6kyhyjIVQGu7DTYHeNYiDXnYgU8:xko6MaFPE6kRjIVQG4Ds+aJm

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

Version

1.4

C2

https://piloferstaf.com/test/

https://ypredoninen.com/test/

Attributes

group
Sigma
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Extracted

Family

latrodectus

aes.hex

Signatures

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Deletes itself 1 IoCs

pid	Process
2372	FixSfp.exe

Executes dropped EXE 2 IoCs

pid	Process
3976	Update_463300b.exe
1864	Update_463300b.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\80337E5CC7C7E749F1FE8354458627336ECF3C92	FixSfp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\80337E5CC7C7E749F1FE8354458627336ECF3C92\Blob = 14000000010000001400000067113a6c9ee4a0b3caa1c960ea2d291efda132a403000000010000001400000080337e5cc7c7e749f1fe8354458627336ecf3c920f00000001000000200000007712ba60e210a459c0c24bcfb48b0566bdf046231eb6138c41431a9262c48b892000000001000000f9020000308202f5308201dda003020102021019d0cee4e154962c57ecba0ab5e23d27300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3235303132363133303030305a170d3330303132363133303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100ba3b9d764caa0a23458e33f03a0c8851360f01ca502d8b387a4f8a735da9bb64b3f87ce9cd5ebffe7bee6fd27fe5d778581c551008751dfed4ef921a3e2991e0c910eb78d9a274f79c85e6f07efcbacde295c7b3df41ec98ba6bc108afe172ad4a1a97c27f806ec141c5c0b2796a34be69d376ee7d086aaf5a0289d9662d070c23d48af823143a06945ac4d73e45275ee75ae8f8db625b2cf51e0f222f47616d07123509a4fca1799d087a1f76685dcdf872c913206d74f384f683a7ce777b0a53c40c376be6a89b00f0086d1d0eece56f783240478c14d25da7ac9e5b3be4662bf09d2dd15a673758a1ec2405f71e30223f7450bd140aa4c0423241c58d05e50203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e0416041467113a6c9ee4a0b3caa1c960ea2d291efda132a4300d06092a864886f70d01010b050003820101009b3030db0dfc0a12ba9ee76d49910c428535aa75b3615149fa79b5a0f6e9745efde8fae6d23cc7a266c8c883d92292e586cad3c815b299fd337868b75737dba5c173488ca972616029aea4c04282027709f7cbd0f85285013de9773b8adcbb143155aaa6071ee01bde859e0a3d2bdf9fd14aa2a07b4c785b2a0b113203328eb85d56b19eb3bf73b75536a7cec87eef04e76ecc810cc510a5b6787db86d8cc697849a204ef8a71a1c457661ff72bee75d06d43e587903d74d11cc71f9c9e12dfb862b7b37267f225fec55c34a426429bbc251bc08dd290be009ca3b583c13e907e2969f1d46752c615dfc83266a9208828331ffeb5dc7963e8069e24a1c9bc9f1	FixSfp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\80337E5CC7C7E749F1FE8354458627336ECF3C92\Blob = 190000000100000010000000a739c22d28b851509301264c81b69f0f0f00000001000000200000007712ba60e210a459c0c24bcfb48b0566bdf046231eb6138c41431a9262c48b8903000000010000001400000080337e5cc7c7e749f1fe8354458627336ecf3c9214000000010000001400000067113a6c9ee4a0b3caa1c960ea2d291efda132a42000000001000000f9020000308202f5308201dda003020102021019d0cee4e154962c57ecba0ab5e23d27300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3235303132363133303030305a170d3330303132363133303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100ba3b9d764caa0a23458e33f03a0c8851360f01ca502d8b387a4f8a735da9bb64b3f87ce9cd5ebffe7bee6fd27fe5d778581c551008751dfed4ef921a3e2991e0c910eb78d9a274f79c85e6f07efcbacde295c7b3df41ec98ba6bc108afe172ad4a1a97c27f806ec141c5c0b2796a34be69d376ee7d086aaf5a0289d9662d070c23d48af823143a06945ac4d73e45275ee75ae8f8db625b2cf51e0f222f47616d07123509a4fca1799d087a1f76685dcdf872c913206d74f384f683a7ce777b0a53c40c376be6a89b00f0086d1d0eece56f783240478c14d25da7ac9e5b3be4662bf09d2dd15a673758a1ec2405f71e30223f7450bd140aa4c0423241c58d05e50203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e0416041467113a6c9ee4a0b3caa1c960ea2d291efda132a4300d06092a864886f70d01010b050003820101009b3030db0dfc0a12ba9ee76d49910c428535aa75b3615149fa79b5a0f6e9745efde8fae6d23cc7a266c8c883d92292e586cad3c815b299fd337868b75737dba5c173488ca972616029aea4c04282027709f7cbd0f85285013de9773b8adcbb143155aaa6071ee01bde859e0a3d2bdf9fd14aa2a07b4c785b2a0b113203328eb85d56b19eb3bf73b75536a7cec87eef04e76ecc810cc510a5b6787db86d8cc697849a204ef8a71a1c457661ff72bee75d06d43e587903d74d11cc71f9c9e12dfb862b7b37267f225fec55c34a426429bbc251bc08dd290be009ca3b583c13e907e2969f1d46752c615dfc83266a9208828331ffeb5dc7963e8069e24a1c9bc9f1	FixSfp.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2372	FixSfp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3976	2372	FixSfp.exe	84
PID 2372 wrote to memory of 3976	2372	FixSfp.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FixSfp.exe
"C:\Users\Admin\AppData\Local\Temp\FixSfp.exe"
1⤵
- Deletes itself
- Modifies system certificate store
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Roaming\Custom_update\Update_463300b.exe
  "C:\Users\Admin\AppData\Roaming\Custom_update\Update_463300b.exe"
  2⤵
  - Executes dropped EXE
  PID:3976

C:\Users\Admin\AppData\Roaming\Custom_update\Update_463300b.exe
C:\Users\Admin\AppData\Roaming\Custom_update\Update_463300b.exe
1⤵
- Executes dropped EXE
PID:1864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Custom_update\Update_463300b.exe

Filesize
1.1MB

MD5
c4738b7ee108e1cfd0619cf740f458e0

SHA1
01c40a43bdf3bb2edfa4b9aa039439a47e9edc6d

SHA256
6ada7b6d8b6ddf3ebe61d3bf19e70bb5a2a9f22d871d217b1ade7c40c3aac088

SHA512
4c4a68739593e02c3997905ab10e7492b64f288a39211a81797cadaf2432aa90f94874e83520bbb149810e04fdc0e401eac30d10402b5c5822887f3b9cbbf2cb

Download Submit
memory/2372-1-0x00007FFE985D0000-0x00007FFE985E0000-memory.dmp

Filesize
64KB

Download
memory/2372-0-0x00007FF6F9CE0000-0x00007FF6F9CF0000-memory.dmp

Filesize
64KB

Download
memory/2372-2-0x0000000140000000-0x0000000141CB2000-memory.dmp

Filesize
28.7MB

Download
memory/2372-6-0x0000016709E40000-0x000001670BAF0000-memory.dmp

Filesize
28.7MB

Download
memory/2372-11-0x00007FF739CA0000-0x00007FF739DC1000-memory.dmp

Filesize
1.1MB

Download
memory/3976-15-0x00007FFE985D0000-0x00007FFE985E0000-memory.dmp

Filesize
64KB

Download
memory/3976-14-0x00007FF76CAC0000-0x00007FF76CAD0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads