Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
14/03/2025, 15:17
General
-
Target
83859acdf4ac22927fa88f715666653807501db6f1865a3657599b4c5d130bb2.dll
-
Size
2.9MB
-
MD5
ae544fbeea5fa73ded6f7560afd44790
-
SHA1
644e5adb482709f313796f3ab16f247f0bce1c9c
-
SHA256
83859acdf4ac22927fa88f715666653807501db6f1865a3657599b4c5d130bb2
-
SHA512
ae63e2dbd53c7876aee30012d38e7ea34f8362ef34ef26935b1ca4cad11eda6e9153fda592bfeaaff0019432882ec130f7ecc4c5038beb2ed502fefa14562c2c
-
SSDEEP
49152:BGIdGbhz/MPFF/6R6MkFjfnm4pzW3GhvRBDsVYArO/0/zoIIdxuS2zPNTQmh5bkp:BlZJqrbzoIIyS5mh5bkOEk1q
Malware Config
Extracted
latrodectus
1.4
https://horetimodual.com/test/
https://forefilarem.com/test/
Signatures
-
Brute Ratel C4
A customized command and control framework for red teaming and adversary simulation.
-
Bruteratel family
-
Detect BruteRatel badger 6 IoCs
-
Detects Latrodectus 4 IoCs
Detects Latrodectus v1.4.
-
Latrodectus family
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Blocklisted process makes network request 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\83859acdf4ac22927fa88f715666653807501db6f1865a3657599b4c5d130bb2.dll,#12⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
304KB
-
Filesize
296KB
-
Filesize
304KB
-
Filesize
296KB
-
Filesize
4KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
296KB
-
Filesize
4KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB