latrodectus | 6366909c439ddf7b243e1cafaf9c8e54d066ca06ff8b3613971e87c27030765a | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/02/2025, 18:40

Sharing

Report Analysis Logs

General

Target

fxghx(7).dll
Size

2.2MB
MD5

fa1ada5addfbb657ba4cb9f2911fee5d
SHA1

20b18976638cf4323f9e60ebb35807ccc8997625
SHA256

6366909c439ddf7b243e1cafaf9c8e54d066ca06ff8b3613971e87c27030765a
SHA512

3e9f5cbd6e476061c1ec04f23df66acab92735126f3e3e066adf74191269f6e871e9e029b2598fbd80002f4bf753cb4c2d29c7548d61f2871938666e48e2c69c
SSDEEP

49152:/ZzQqIEjvDQPOnR5mSBn/VSlsBzXHWtSyZS:/YcxyZ

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

Version

1.4

C2

https://apworsindos.com/test/

https://reminasolirol.com/test/

Attributes

group
Mimikast
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Extracted

Family

latrodectus

aes.hex

Signatures

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2396	2096	rundll32.exe	30
PID 2096 wrote to memory of 2396	2096	rundll32.exe	30
PID 2096 wrote to memory of 2396	2096	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fxghx(7).dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2096 -s 128
  2⤵
  PID:2396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2096-0-0x0000000180000000-0x0000000181CB2000-memory.dmp

Filesize
28.7MB

Download
memory/2096-3-0x0000000001F90000-0x0000000003C41000-memory.dmp

Filesize
28.7MB

Download