latrodectus | 31e2cd5214dbb4dc41312d3a868a7ea5be95c40468320eb178bbb0201efee721

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 01:54

Target

7040402574a686f031c3af5fed37509d8979855397787aab70b2d1059099d2da.dll
Size

69KB
MD5

ff354796f9e0a1edea31b8c9f65cda1b
SHA1

eae04a4c6b9ea586e9d7f2a351de06e90d64a5bb
SHA256

7040402574a686f031c3af5fed37509d8979855397787aab70b2d1059099d2da
SHA512

ef63fc4efc8d78dc8ea22dbcf05150406d89ea95b3dd3c154cc6a7fe39882844d089ecd08955d410a3031af9dce7a061cbea9db2ca5608795faee6132c2ed2ee
SSDEEP

768:RirkZkx7jOxt0Io0O99dyyus8GhrFuNtxv4c/HFGKndcHrqzwzv1NTNaTWsyih:Ri1dj7aO9qyVNKv4c/HFGLlzvi

Score

10^/10

Family

latrodectus

https://winarkamaps.com/live/

https://stratimasesstr.com/live/

Latrodectus loader
Latrodectus is a loader written in C++.
loader latrodectus
Detect larodectus Loader variant 2 1 IoCs
loader

Processes:

resource yara_rule

behavioral1/memory/2220-0-0x0000000000110000-0x0000000000124000-memory.dmp family_latrodectus_v2
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2220 rundll32.exe
2220 rundll32.exe

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000110000-0x0000000000124000-memory.dmp	family_latrodectus_v2

pid	process
2220	rundll32.exe
2220	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7040402574a686f031c3af5fed37509d8979855397787aab70b2d1059099d2da.dll,#1
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2220

memory/2220-0-0x0000000000110000-0x0000000000124000-memory.dmp

Filesize
80KB

Download