Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/09/2026, 18:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target 2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399.msi
- Size 2.0MB
- Sample260917-wtymwathrf
- SHA256 2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399
- MD5 b13b0cf148e3a25cbad37604956df69d
- SHA1 b7136c309dd803a1303c6d93c1aafebb00e1b6bd
- SHA512 af79999ff2b12d6fd32fd0fdaf0a69b23f5ad196035d9a521ff959960c29a9ee7a2dd781f8e5cd1b82677554afd370d97bb17d4434e177cc4ef215df08fefd49
- SSDEEP 24576:fBlIwwkElBoKQs8pRUm6rPtWYW/x91J8/k:fBmQEjoY8Xbm
- TLSH T10CA5295DAE3A806EC21DC53D9817957ABF703CD48B2AF2D742122A19DF3E3E41639358
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
latrodectus
C2
-
https://arsimonopa.com/live/
-
https://lemonimonakio.com/live/
Attributes
-
group
Novik
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Signatures
- Family: Latrodectus loader
Latrodectus is a loader written in C++.
- Detect larodectus Loader variant 1 3 IoCs
resource yara_rule behavioral2/memory/2684-40-0x0000028599C10000-0x0000028599C23000-memory.dmp family_latrodectus_v1 behavioral2/memory/3324-53-0x000001BB2FA10000-0x000001BB2FA23000-memory.dmp family_latrodectus_v1 behavioral2/memory/3324-58-0x000001BB2FA10000-0x000001BB2FA23000-memory.dmp family_latrodectus_v1 - Loads dropped DLL 4 IoCs
pid Process 1824 MsiExec.exe 4324 rundll32.exe 2684 rundll32.exe 3324 rundll32.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI103D.tmp-\test.old.cs.dll rundll32.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF08961CFB146599DF.TMP msiexec.exe File opened for modification C:\Windows\Installer\e5a0e2a.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI103D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI103D.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI103D.tmp-\WixSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI281C.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF4C48D00868AB4819.TMP msiexec.exe File created C:\Windows\Installer\e5a0e2a.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{02C6E29E-995C-4F09-890C-8FBD7C9B4E2B} msiexec.exe File created C:\Windows\SystemTemp\~DF36E2F6C6BE07568E.TMP msiexec.exe File created C:\Windows\Installer\e5a0e2c.msi msiexec.exe File created C:\Windows\SystemTemp\~DF1C09C669EE86B227.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI103D.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3160 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2036 msiexec.exe 2036 msiexec.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 2684 rundll32.exe 3324 rundll32.exe 3324 rundll32.exe 3324 rundll32.exe 3324 rundll32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3160 msiexec.exe Token: SeIncreaseQuotaPrivilege 3160 msiexec.exe Token: SeSecurityPrivilege 2036 msiexec.exe Token: SeCreateTokenPrivilege 3160 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3160 msiexec.exe Token: SeLockMemoryPrivilege 3160 msiexec.exe Token: SeIncreaseQuotaPrivilege 3160 msiexec.exe Token: SeMachineAccountPrivilege 3160 msiexec.exe Token: SeTcbPrivilege 3160 msiexec.exe Token: SeSecurityPrivilege 3160 msiexec.exe Token: SeTakeOwnershipPrivilege 3160 msiexec.exe Token: SeLoadDriverPrivilege 3160 msiexec.exe Token: SeSystemProfilePrivilege 3160 msiexec.exe Token: SeSystemtimePrivilege 3160 msiexec.exe Token: SeProfSingleProcessPrivilege 3160 msiexec.exe Token: SeIncBasePriorityPrivilege 3160 msiexec.exe Token: SeCreatePagefilePrivilege 3160 msiexec.exe Token: SeCreatePermanentPrivilege 3160 msiexec.exe Token: SeBackupPrivilege 3160 msiexec.exe Token: SeRestorePrivilege 3160 msiexec.exe Token: SeShutdownPrivilege 3160 msiexec.exe Token: SeDebugPrivilege 3160 msiexec.exe Token: SeAuditPrivilege 3160 msiexec.exe Token: SeSystemEnvironmentPrivilege 3160 msiexec.exe Token: SeChangeNotifyPrivilege 3160 msiexec.exe Token: SeRemoteShutdownPrivilege 3160 msiexec.exe Token: SeUndockPrivilege 3160 msiexec.exe Token: SeSyncAgentPrivilege 3160 msiexec.exe Token: SeEnableDelegationPrivilege 3160 msiexec.exe Token: SeManageVolumePrivilege 3160 msiexec.exe Token: SeImpersonatePrivilege 3160 msiexec.exe Token: SeCreateGlobalPrivilege 3160 msiexec.exe Token: SeBackupPrivilege 3244 vssvc.exe Token: SeRestorePrivilege 3244 vssvc.exe Token: SeAuditPrivilege 3244 vssvc.exe Token: SeBackupPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe Token: SeTakeOwnershipPrivilege 2036 msiexec.exe Token: SeRestorePrivilege 2036 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3160 msiexec.exe 3160 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3160 msiexec.exe 2036 msiexec.exe 1824 MsiExec.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2036 wrote to memory of 4260 2036 msiexec.exe 91 PID 2036 wrote to memory of 1824 2036 msiexec.exe 93 PID 1824 wrote to memory of 4324 1824 MsiExec.exe 94 PID 4324 wrote to memory of 2684 4324 rundll32.exe 96 PID 2684 wrote to memory of 3324 2684 rundll32.exe 97 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3160
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4260
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 5EA25A1FF26EDD41E163D2863C69C6802⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI103D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240783828 2 test.old.cs!Test.CustomActions.MyAction3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\tmp203B.dll",scab4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\System32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\Custom_update\Update_669f8fa5.dll", scab5⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3324
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3244
-
C:\Windows\system32\rundll32.exerundll32.exe1⤵PID:2460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a0e2b.rbs
- Size 8KB
- SHA256 389102cf4a7e5e31870351795eb345962288b3eb37bac65bc1c522dc81db80e5
- MD5 11be304176fb20edf45a78eec0a105c2
- SHA1 6c4f31db02aa2a04b2faa9b345dccd1f8089be61
- SHA512 6e9ac227ca8515103e65e49b937d2e03ed73274a1ab703ca8a29f7f0e092fcbc583ae92e5f0bf1ecdf6898975208ace28eb534c66d1cf6530cb1041510beba65
- SSDEEP 96:7mmedv9TChu51Uy6TCsTlSUy6TC6jexq07Tl+NrsIH5XGwwBIP5lCLprBeO5HaIE:yDvtCAOXOIrXOxrgHBG7LpsT
- TLSH T1DD12FF86724484D2DD592733D25F0BA0BBB3E6EDC720A70B4ACEC4244F537DCAE4949A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp203B.dll
- Size 1.6MB
- SHA256 d51d38f49f7b810bccd6a41159e8e5142aceff1d6be775a34c2c7c54eda192d9
- MD5 986c2e054d91a9466fbfadf0a5e22168
- SHA1 583dd35705afedf2d068f3477b481fc9654ec6b7
- SHA512 9106ae09b2732a2a9c8164fef5d5fc4f2c673a6fb6615a6269a286a24c0d4e3118575f05b78fdfd999540efaa2e09df5ec384b705716f059aa02d21b924286a0
- SSDEEP 12288:vNKxnAQSV07d+8Ttg6XLLRtGDzm6rPGB3cNWYW/x91J8emFk:PQs8pRUm6rPtWYW/x91J8/k
- TLSH T15175E85DEE3A846EC21DC53D9817957ABF7038D48B2AF2D782120E1ADF1E3E41639358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI103D.tmp
- Size 408KB
- SHA256 63de2da6690ec48231b10585e8eeb1d320925568d55ed8de22e6cfdbb197ca2a
- MD5 0421886125b50123188287996979264e
- SHA1 a7a3015012a668d35d9375a91ebc06ead1903477
- SHA512 4cb61236b634ee1ddd44e192fbba24a47b1f6f8abefa758e7e804e5d1e3fba79396e2d65a5f8cd5dd1dc56c60415ed4d8d586a752491c056b3d6004724764eb5
- SSDEEP 6144:1bQPZlIPqZkJf8iivLsrywrt7CtIM6VdZ3HrerHhvl/CBoUAaNHjT:qBlIPDf8NLQyw1KI3VdZbeFvWoUAyv
- TLSH T18A94D016B3E51066F8779A35C9274A15E6337C022B71D71F03A0427ADE3F7A1A639F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 fc84e2c6b621c0db74d485c1a88124d85a9a0f578d6e466418527d60adf838f5
- MD5 95d922d7c9424a34c25c389851f6bd70
- SHA1 2fe0f27b10343aef60680c471a117b938c92d54b
- SHA512 2e28856a9399b608ee0e93dfee84f3e0212b71952d1386ec550583023d2c167e4ed8cca9ecfaa1a0cfcf045e6e1e1f2004dc9e546cba025bb5fb6a855fe9bc15
- SSDEEP 24576:RFo3DMPHdoO/vvTL/Sgn3iFwfru9MrwkEqhl9qJfBiJ6JQ2XMYR23uNmz+7:jHc
- TLSH T10457022472F92211E7F39E3CA8F06A23493E7D9B9C15DE8D45411B4E0862F71E872F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{3150e923-f439-43cd-b5be-bbb9d38b4cfe}_OnDiskSnapshotProp
- Size 6KB
- SHA256 3f1c1f0137903654ebeb6e574e08d390132741d276b846520d1a110b31d04fcc
- MD5 a048434ee616a98235fcb19f85358ab4
- SHA1 e37781fba0edbd05bbd88f35376b246a30b44f52
- SHA512 5f2b00cb8eda99e2e39c579940d748db7d52c0d33a1853253b6daff047d815a5c8d3cbfb77f61d48e93fb1ee2139151fcee0856252dee0cb514f8d7b8d09eb49
- SSDEEP 96:FaVnj9vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:wV1b++uVmN
- TLSH T16FD18A085AF54711E2F3AB3129F18557A877B911EF33CB8E0194238E6670A10F975F6B
- MD5 SHA1 SHA512 SSDEEP TLSH