latrodectus | bdca22607853800b711335b8d5e50e21e1e4859f7db7382b512dd1330274f90d | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
06/02/2025, 18:50

Sharing

Report Analysis Logs

General

Target

fxghx12.dll
Size

2.2MB
MD5

93189cbce2906d18ffd4e9cb2a829315
SHA1

f9ea3577aff1ab0f03eae60edb678dc43d3fe70d
SHA256

bdca22607853800b711335b8d5e50e21e1e4859f7db7382b512dd1330274f90d
SHA512

1f982538ea45383097f7924f61144f6d959a07d2df6eaca2683832f238bd6603bfa3879695da489782d81a9a2d57a8dbf5635fed2c48eecdff459e6fcf0a3a6e
SSDEEP

49152:/ZzQqIEjvDQPOnR5mSBn/VSlsBzXHWtSyZS:/YcxyZ

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

Version

1.4

C2

https://apworsindos.com/test/

https://reminasolirol.com/test/

Attributes

group
Mimikast
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Extracted

Family

latrodectus

aes.hex

Signatures

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2508	2928	rundll32.exe	30
PID 2928 wrote to memory of 2508	2928	rundll32.exe	30
PID 2928 wrote to memory of 2508	2928	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fxghx12.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2928 -s 128
  2⤵
  PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2928-2-0x0000000180000000-0x0000000181CB2000-memory.dmp

Filesize
28.7MB

Download
memory/2928-4-0x0000000002010000-0x0000000003CC1000-memory.dmp

Filesize
28.7MB

Download