latrodectus | 8b1f0fb8b0c93823e5c8f77b0814562a416eaa02072244ce69815c6e9b548f7a | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-02-2025 18:51

Sharing

Report Analysis Logs

General

Target

fxghx8.dll
Size

2.2MB
MD5

51a202e07a388762720ff5d21da7996c
SHA1

62b14da0c89d6ffc887b88a8d3ec3382bb70e497
SHA256

8b1f0fb8b0c93823e5c8f77b0814562a416eaa02072244ce69815c6e9b548f7a
SHA512

a075c93479facf9173e7fa79757eab231b6981f26a929b9cbcaa366a861b370826397f646eb49f185eaeaa93bb927c06bad13f2169d02050a34ac325ecb66bf7
SSDEEP

49152:/ZzQqIEjvDQPOnR5mSBn/VSlsBzXHWtSyZS:/YcxyZ

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

Version

1.4

C2

https://apworsindos.com/test/

https://reminasolirol.com/test/

Attributes

group
Mimikast
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Extracted

Family

latrodectus

aes.hex

Signatures

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2672	3040	rundll32.exe	31
PID 3040 wrote to memory of 2672	3040	rundll32.exe	31
PID 3040 wrote to memory of 2672	3040	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fxghx8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3040 -s 128
  2⤵
  PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x0000000180000000-0x0000000181CB2000-memory.dmp

Filesize
28.7MB

Download
memory/3040-4-0x0000000001E00000-0x0000000003AB1000-memory.dmp

Filesize
28.7MB

Download