latrodectus | 6ada7b6d8b6ddf3ebe61d3bf19e70bb5a2a9f22d871d217b1ade7c40c3aac088

General

Target

FixSfp.exe
Size

1.1MB
MD5

c4738b7ee108e1cfd0619cf740f458e0
SHA1

01c40a43bdf3bb2edfa4b9aa039439a47e9edc6d
SHA256

6ada7b6d8b6ddf3ebe61d3bf19e70bb5a2a9f22d871d217b1ade7c40c3aac088
SHA512

4c4a68739593e02c3997905ab10e7492b64f288a39211a81797cadaf2432aa90f94874e83520bbb149810e04fdc0e401eac30d10402b5c5822887f3b9cbbf2cb
SSDEEP

24576:xFdIR2uJMaFHaNfZq8gGl6kyhyjIVQGu7DTYHeNYiDXnYgU8:xko6MaFPE6kRjIVQG4Ds+aJm

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

Version

1.4

C2

https://piloferstaf.com/test/

https://ypredoninen.com/test/

Attributes

group
Sigma
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Extracted

Family

latrodectus

aes.hex

Signatures

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Deletes itself 1 IoCs

pid	Process
2184	FixSfp.exe

Executes dropped EXE 2 IoCs

pid	Process
2316	Update_5ca24c8f.exe
2112	Update_5ca24c8f.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\209453EAC5912DDBFF82D8949D54E16486C44AD5	FixSfp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\209453EAC5912DDBFF82D8949D54E16486C44AD5\Blob = 140000000100000014000000345fa35b1f8b714769f348e27e5990d165ff1021030000000100000014000000209453eac5912ddbff82d8949d54e16486c44ad50f00000001000000200000008acbb522d7e1e4adeda28133660396df3a9d8d06b3f67370e88d9b1a8a8639d72000000001000000f9020000308202f5308201dda00302010202103ef41c9a40616e5baf144237b6d638f7300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3235303132363137303030305a170d3330303132363137303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100c6a9b189154715c046af5e58da0af1ef487bf41bfc5b6efbd22476b40211a96a70716ce1ddb2688d469f2d38697e69a3bac95434a1fca0da7a1272c3599d779c54ae94d0ce3fa3683998e2f7f4fee004fd204ad482aa70ad76ac1a6ba83ab090a884bf3ee501812b275cf6f6689c4822a69d92ecd89dd94b542222bef8e06344c69edf4dc6b74e0e130c4e9e4a0797afea424d4e52a3f673c022e7061b1fd7b82a3163d69f5c6dd1ca9cfc15b90700d7c632f9c5f136be58b13070ed90f8ed6edfb5457ad67a255d9c7586bfe9b45b2c2dad5b5620e3133f7a162847a8ef5011de6e8150fba411ea940e64bf983d674b3c7eedcdaf6c657ff977e6ded434b1350203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414345fa35b1f8b714769f348e27e5990d165ff1021300d06092a864886f70d01010b050003820101003f49b9eb7f2ce47830b8aa182d867584691b3c141b66e38ac3d7ee80bb95af230ce8f997838b09209969635bc6c0b640c250ad99597b7dadf958922f701e9a57cd2bc18d607d14400249e125c5ead2ebc6103cac593679978cf510f640c4e8ff7bc0a61a84f453b4193770dd70d856334419eabd61e4a70e63faf04d52c8ac7b2971a30d9ef1b71683aea4a2fd21f7776ade13810bc4f810c7ed643fc8bc11a31c4ffdf3bf1ab21621af0a668b32be2b266c2d7c7edba978baf18f3ee01dd18fa90948381813fde71fb7e0640a2eedf86c2d8c6090f57ec426d255e8a1142cc496ad7c598b2aa90a4e74745aed1a124c144262dbacabe5bb4e1e9ec6f7be7aa2	FixSfp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\209453EAC5912DDBFF82D8949D54E16486C44AD5\Blob = 190000000100000010000000eeaa360d9b809b4b028ee501d157d4460f00000001000000200000008acbb522d7e1e4adeda28133660396df3a9d8d06b3f67370e88d9b1a8a8639d7030000000100000014000000209453eac5912ddbff82d8949d54e16486c44ad5140000000100000014000000345fa35b1f8b714769f348e27e5990d165ff10212000000001000000f9020000308202f5308201dda00302010202103ef41c9a40616e5baf144237b6d638f7300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3235303132363137303030305a170d3330303132363137303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100c6a9b189154715c046af5e58da0af1ef487bf41bfc5b6efbd22476b40211a96a70716ce1ddb2688d469f2d38697e69a3bac95434a1fca0da7a1272c3599d779c54ae94d0ce3fa3683998e2f7f4fee004fd204ad482aa70ad76ac1a6ba83ab090a884bf3ee501812b275cf6f6689c4822a69d92ecd89dd94b542222bef8e06344c69edf4dc6b74e0e130c4e9e4a0797afea424d4e52a3f673c022e7061b1fd7b82a3163d69f5c6dd1ca9cfc15b90700d7c632f9c5f136be58b13070ed90f8ed6edfb5457ad67a255d9c7586bfe9b45b2c2dad5b5620e3133f7a162847a8ef5011de6e8150fba411ea940e64bf983d674b3c7eedcdaf6c657ff977e6ded434b1350203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414345fa35b1f8b714769f348e27e5990d165ff1021300d06092a864886f70d01010b050003820101003f49b9eb7f2ce47830b8aa182d867584691b3c141b66e38ac3d7ee80bb95af230ce8f997838b09209969635bc6c0b640c250ad99597b7dadf958922f701e9a57cd2bc18d607d14400249e125c5ead2ebc6103cac593679978cf510f640c4e8ff7bc0a61a84f453b4193770dd70d856334419eabd61e4a70e63faf04d52c8ac7b2971a30d9ef1b71683aea4a2fd21f7776ade13810bc4f810c7ed643fc8bc11a31c4ffdf3bf1ab21621af0a668b32be2b266c2d7c7edba978baf18f3ee01dd18fa90948381813fde71fb7e0640a2eedf86c2d8c6090f57ec426d255e8a1142cc496ad7c598b2aa90a4e74745aed1a124c144262dbacabe5bb4e1e9ec6f7be7aa2	FixSfp.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2184	FixSfp.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2316	2184	FixSfp.exe	79
PID 2184 wrote to memory of 2316	2184	FixSfp.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FixSfp.exe
"C:\Users\Admin\AppData\Local\Temp\FixSfp.exe"
1⤵
- Deletes itself
- Modifies system certificate store
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Roaming\Custom_update\Update_5ca24c8f.exe
  "C:\Users\Admin\AppData\Roaming\Custom_update\Update_5ca24c8f.exe"
  2⤵
  - Executes dropped EXE
  PID:2316

C:\Users\Admin\AppData\Roaming\Custom_update\Update_5ca24c8f.exe
C:\Users\Admin\AppData\Roaming\Custom_update\Update_5ca24c8f.exe
1⤵
- Executes dropped EXE
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Custom_update\Update_5ca24c8f.exe

Filesize
1.1MB

MD5
c4738b7ee108e1cfd0619cf740f458e0

SHA1
01c40a43bdf3bb2edfa4b9aa039439a47e9edc6d

SHA256
6ada7b6d8b6ddf3ebe61d3bf19e70bb5a2a9f22d871d217b1ade7c40c3aac088

SHA512
4c4a68739593e02c3997905ab10e7492b64f288a39211a81797cadaf2432aa90f94874e83520bbb149810e04fdc0e401eac30d10402b5c5822887f3b9cbbf2cb

Download Submit
memory/2184-0-0x00007FF6702C0000-0x00007FF6702D0000-memory.dmp

Filesize
64KB

Download
memory/2184-1-0x00007FFBE6CD0000-0x00007FFBE6CE0000-memory.dmp

Filesize
64KB

Download
memory/2184-2-0x0000000140000000-0x0000000141CB2000-memory.dmp

Filesize
28.7MB

Download
memory/2184-6-0x0000014418570000-0x000001441A220000-memory.dmp

Filesize
28.7MB

Download
memory/2184-15-0x00007FF6B0280000-0x00007FF6B03A1000-memory.dmp

Filesize
1.1MB

Download
memory/2316-14-0x00007FFBE6CD0000-0x00007FFBE6CE0000-memory.dmp

Filesize
64KB

Download
memory/2316-13-0x00007FF5D0130000-0x00007FF5D0140000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads