latrodectus | 348f23942bb5bf421bd1e611fa816af23bea87378c4dfa6d80f2caa4e536a2b2 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-02-2025 23:55

Sharing

Report Analysis Logs

General

Target

SecuriteInfo.com.Win64.Evo-gen.18185.16740.dll
Size

2.2MB
MD5

1f4f7c5154d73bbcfb88dbfd0a7b131c
SHA1

2f191b0c9b38f9e5ba1b1e6534c291b7fa36a1cb
SHA256

348f23942bb5bf421bd1e611fa816af23bea87378c4dfa6d80f2caa4e536a2b2
SHA512

13e1e8bb87e215a44860df44db0667b552049bcb8ad3621dc6f2e5b29dd61ca2659041e7ce66b326fb78eced183c614b2da09516274c4f493cd5a2a090a11cfd
SSDEEP

49152:/ZzQqIEjvDQPOnR5mSBn/VSlsBzXHWtSyZS:/YcxyZ

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

Version

1.4

C2

https://apworsindos.com/test/

https://reminasolirol.com/test/

Attributes

group
Mimikast
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Extracted

Family

latrodectus

aes.hex

Signatures

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2368	2404	rundll32.exe	30
PID 2404 wrote to memory of 2368	2404	rundll32.exe	30
PID 2404 wrote to memory of 2368	2404	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.Evo-gen.18185.16740.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2404 -s 128
  2⤵
  PID:2368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-1-0x0000000180000000-0x0000000181CB2000-memory.dmp

Filesize
28.7MB

Download
memory/2404-4-0x0000000001FB0000-0x0000000003C61000-memory.dmp

Filesize
28.7MB

Download