Overview

overview

10

Static

static

3

aswavdetection.dll

windows7-x64

10

aswavdetection.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/03/2025, 22:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aswavdetection.dll

  • Size

    1.8MB

  • MD5

    22e933c9c5532d13fbcae3d9f2080c35

  • SHA1

    6311eb48932a5544cbe3c2c2fe2b036231432bd4

  • SHA256

    52a81e514d1113019f39273179f691379fbb78cd70a370aea22a00397cef5b99

  • SHA512

    20a4d7d2328332dc017fd4ced63c8efc45ac90d749db06345422749545cd4391682d37a01b9a91b21b5e70f1f8c8006c80b7e35ed696a239f76911ddf50ed5ac

  • SSDEEP

    49152:9srSb808eyLlSRqVNPseFyTJ1CLXuzYYjc8F4HcDsYfPFGMSugRP:KL1PYTI9Hco

Score
10/10
latrodectusloader

Malware Config

Extracted

Family

latrodectus

Version

1.4

C2

https://remustarofilac.com/test/

https://horetimodual.com/test/
Attributes
  • group

    Ferrary

  • user_agent

    Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)

aes.hex

Extracted

Family

latrodectus

aes.hex

Signatures

  • Latrodectus family
    latrodectus
  • Latrodectus loader

    Latrodectus is a loader written in C++.

    loaderlatrodectus
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\aswavdetection.dll,#1
    1⤵
    • Deletes itself
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Windows\system32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_6762b44b.dll", #1
      2⤵
      • Loads dropped DLL
      PID:4308

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Custom_update\Update_6762b44b.dll
    Filesize

    1.8MB

    MD5

    22e933c9c5532d13fbcae3d9f2080c35

    SHA1

    6311eb48932a5544cbe3c2c2fe2b036231432bd4

    SHA256

    52a81e514d1113019f39273179f691379fbb78cd70a370aea22a00397cef5b99

    SHA512

    20a4d7d2328332dc017fd4ced63c8efc45ac90d749db06345422749545cd4391682d37a01b9a91b21b5e70f1f8c8006c80b7e35ed696a239f76911ddf50ed5ac

    Download Submit

  • memory/2596-0-0x0000000180000000-0x0000000181CB2000-memory.dmp

    Filesize

    28.7MB

    Download

  • memory/2596-4-0x000002106B200000-0x000002106CEB1000-memory.dmp

    Filesize

    28.7MB

    Download

  • memory/2596-10-0x00007FF9A4550000-0x00007FF9A4723000-memory.dmp

    Filesize

    1.8MB

    Download