latrodectus | 9263519b5b9c17ebd05e068b34476e9a5e39c8b043cb9981ec5faaa883b7b667 | Triage

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
07-02-2025 15:15

Sharing

Report Analysis Logs

General

Target

KI2TC403469M29HH3Z3QDLRSHS.dll
Size

2.2MB
MD5

7146b9f40f708c36796d16a13641986e
SHA1

e61db5efc56cf56c8e44ab940aef0fb674a06c37
SHA256

9263519b5b9c17ebd05e068b34476e9a5e39c8b043cb9981ec5faaa883b7b667
SHA512

1641d17d4943a732769bb11dfee1e02becbd9a1e5e1820c3c0d022f5668d240a8e5069e48fe474dd9fcdd00095f4bea366a08414b54d19aea564459204525aa3
SSDEEP

49152:2ZzQqIEjvDQPOnRdmSBn/VSlsB/XHW0xyexg:2YYRyN

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

Version

1.4

C2

https://apworsindos.com/test/

https://reminasolirol.com/test/

Attributes

group
Mimikast
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Extracted

Family

latrodectus

aes.hex

Signatures

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2452	1948	rundll32.exe	30
PID 1948 wrote to memory of 2452	1948	rundll32.exe	30
PID 1948 wrote to memory of 2452	1948	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\KI2TC403469M29HH3Z3QDLRSHS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1948 -s 128
  2⤵
  PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-0-0x0000000180000000-0x0000000181CB2000-memory.dmp

Filesize
28.7MB

Download
memory/1948-4-0x0000000001FF0000-0x0000000003CA1000-memory.dmp

Filesize
28.7MB

Download