latrodectus | 4d6970c214f9ccfd2569292e75a3900f084c53291f402ac67a82d5f25e6e6fc5 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/02/2025, 18:58

Sharing

Report Analysis Logs

General

Target

fxghx2.dll
Size

2.2MB
MD5

2ec5ce52d41c58ec86bd6448c557d298
SHA1

5a30a594bb915b6b0adcde2bc6365baeac06380b
SHA256

4d6970c214f9ccfd2569292e75a3900f084c53291f402ac67a82d5f25e6e6fc5
SHA512

461c7a04a2b0f88cb0c7d1d59086e1142f37c99a8ccc8f318a8f7862fc40d3a38d2f67eeabfce111916fb1ebdf8288eb83a76bb6654101effe4e6f90ec77f04e
SSDEEP

49152:/ZzQqIEjvDQPOnR5mSBn/VSlsBzXHWtSyZS:/YcxyZ

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

Version

1.4

C2

https://apworsindos.com/test/

https://reminasolirol.com/test/

Attributes

group
Mimikast
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Extracted

Family

latrodectus

aes.hex

Signatures

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2408	3056	rundll32.exe	30
PID 3056 wrote to memory of 2408	3056	rundll32.exe	30
PID 3056 wrote to memory of 2408	3056	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fxghx2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3056 -s 128
  2⤵
  PID:2408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-2-0x0000000180000000-0x0000000181CB2000-memory.dmp

Filesize
28.7MB

Download
memory/3056-4-0x0000000002100000-0x0000000003DB1000-memory.dmp

Filesize
28.7MB

Download