latrodectus | 9b28bbe25a2538646ab4c9d38616aec75dfe40beab1764812b03433223931b0b

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-02-2025 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b28bbe25a2538646ab4c9d38616aec75dfe40beab1764812b03433223931b0b.dll
Size

2.2MB
MD5

db19545cd739771314c6ccdac332927e
SHA1

821da5c7ae41ffe12efacf73e0164ae7cd1d9bc2
SHA256

9b28bbe25a2538646ab4c9d38616aec75dfe40beab1764812b03433223931b0b
SHA512

477c2857b48ea03a13b5134af1b68194afffb631a8dd1bf6d0720944964548be8674d464394b7464eada2ac11f7d240c3473dd71597850d9b246268412c7fa83
SSDEEP

49152:2ZzQqIEjvDQPOnRdmSBn/VSlsB/XHW0xyexg1:2YYRyN1

Score

10^/10

latrodectus loader

Malware Config

Extracted

Family

latrodectus

Version

1.4

https://apworsindos.com/test/

https://reminasolirol.com/test/

Attributes

group
Mimikast
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Extracted

Family

latrodectus

aes.hex

Signatures

Latrodectus family
latrodectus
Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 1584	2484	rundll32.exe	30
PID 2484 wrote to memory of 1584	2484	rundll32.exe	30
PID 2484 wrote to memory of 1584	2484	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9b28bbe25a2538646ab4c9d38616aec75dfe40beab1764812b03433223931b0b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2484 -s 128
  2⤵
  PID:1584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2484-2-0x0000000180000000-0x0000000181CB2000-memory.dmp

Filesize
28.7MB

Download
memory/2484-4-0x0000000001E10000-0x0000000003AC1000-memory.dmp

Filesize
28.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads