Skip to content

S1160 Latrodectus

Latrodectus is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. Latrodectus has most often been distributed through email campaigns, primarily by TA577 and TA578, and has infrastructure overlaps with historic IcedID operations.312

Item Value
ID S1160
Associated Names IceNova, Unidentified 111
Type MALWARE
Version 1.0
Created 16 September 2024
Last Modified 30 September 2024
Navigation Layer View In ATT&CK® Navigator

Associated Software Descriptions

Name Description
IceNova 1
Unidentified 111 1

Techniques Used

Domain ID Name Use
enterprise T1087 Account Discovery -
enterprise T1087.002 Domain Account Latrodectus can run C:\Windows\System32\cmd.exe /c net group "Domain Admins" /domain to identify domain administrator accounts.5
enterprise T1071 Application Layer Protocol -
enterprise T1071.001 Web Protocols Latrodectus can send registration information to C2 via HTTP POST.352
enterprise T1547 Boot or Logon Autostart Execution -
enterprise T1547.001 Registry Run Keys / Startup Folder
Latrodectus can set an AutoRun key to establish persistence.3
enterprise T1059 Command and Scripting Interpreter -
enterprise T1059.003 Windows Command Shell The Latrodectus command handler can use cmdexe to run multiple discovery commands.52
enterprise T1059.007 JavaScript Latrodectus has used JavaScript files as part its infection chain during malicious spam
email campaigns.524
enterprise T1132 Data Encoding -
enterprise T1132.001 Standard Encoding Latrodectus has Base64-encoded the message body of a HTTP request sent to C2.35
enterprise T1005 Data from Local System Latrodectus can collect data from a compromised host using a stealer module.2
enterprise T1622 Debugger Evasion
Latrodectus has the ability to check for the presence of debuggers.3
enterprise T1140 Deobfuscate/Decode Files or Information Latrodectus has the ability to deobfuscate encrypted strings.352
enterprise T1482 Domain Trust Discovery Latrodectus can run C:\Windows\System32\cmd.exe /c nltest /domain_trusts to discover domain trusts.52
enterprise T1573 Encrypted Channel -
enterprise T1573.001 Symmetric Cryptography Latrodectus can send RC4 encrypted data over C2 channels.352
enterprise T1041 Exfiltration Over C2 Channel
Latrodectus can exfiltrate encrypted system information to the C2 server.32
enterprise T1083 File and Directory Discovery Latrodectus can collect desktop filenames.325
enterprise T1564 Hide Artifacts -
enterprise T1564.004 NTFS File Attributes Latrodectus can delete itself while its process is still running through the use of an alternate data stream.5
enterprise T1070 Indicator Removal -
enterprise T1070.004 File Deletion Latrodectus has the ability to delete itself.52
enterprise T1105 Ingress Tool Transfer Latrodectus can download and execute PEs, DLLs, and shellcode from C2.352
enterprise T1559 Inter-Process Communication -
enterprise T1559.001 Component Object Model Latrodectus can use the Windows Component Object Model (COM) to set scheduled tasks.52
enterprise T1036 Masquerading -
enterprise T1036.005 Match Legitimate Resource Name or Location Latrodectus has been packed to appear as a component to Bitdefender’s kernel-mode driver, TRUFOS.SYS.5
enterprise T1104 Multi-Stage Channels
Latrodectus has used a two-tiered C2 configuration with tier one nodes connecting to the victim and tier two nodes connecting to backend infrastructure.3
enterprise T1106 Native API Latrodectus has used multiple Windows API post exploitation including GetAdaptersInfo, CreateToolhelp32Snapshot, and CreateProcessW.52
enterprise T1135 Network Share Discovery
Latrodectus can run C:\Windows\System32\cmd.exe /c net view /all to discover network shares.52
enterprise T1027 Obfuscated Files or Information -
enterprise T1027.001 Binary Padding Latrodectus has been obfuscated with a 129 byte sequence of junk data prepended to the file.5
enterprise T1027.002 Software Packing The Latrodectus payload has been packed for obfuscation.5
enterprise T1027.007 Dynamic API Resolution
Latrodectus can resolve Windows APIs dynamically by hash.3
enterprise T1027.013 Encrypted/Encoded File Latrodectus has used a pseudo random number generator (PRNG) algorithm and a rolling XOR key to obfuscate strings.352
enterprise T1069 Permission Groups Discovery -
enterprise T1069.002 Domain Groups Latrodectus can identify domain groups through cmd.exe /c net group "Domain Admins" /domain.25
enterprise T1566 Phishing -
enterprise T1566.001 Spearphishing Attachment Latrodectus has been distributed through reply-chain phishing emails with malicious attachments.1
enterprise T1566.002 Spearphishing Link Latrodectus has been distributed to victims through emails containing malicious links.31
enterprise T1057 Process Discovery
Latrodectus can enumerate running processes including process grandchildren on targeted hosts.352
enterprise T1021 Remote Services -
enterprise T1021.005 VNC
Latrodectus has routed C2 traffic using Keyhole VNC.4
enterprise T1053 Scheduled Task/Job -
enterprise T1053.005 Scheduled Task
Latrodectus can create scheduled tasks for persistence.352
enterprise T1518 Software Discovery -
enterprise T1518.001 Security Software Discovery Latrodectus has the ability to identify installed antivirus products.52
enterprise T1218 System Binary Proxy Execution -
enterprise T1218.007 Msiexec Latrodectus has called msiexec to install remotely-hosted MSI files.31
enterprise T1218.011 Rundll32 Latrodectus can use rundll32.exe to execute downloaded DLLs.51
enterprise T1082 System Information Discovery
Latrodectus can gather operating system information.3552
enterprise T1016 System Network Configuration Discovery Latrodectus can discover the IP and MAC address of a targeted host.52
enterprise T1033 System Owner/User Discovery Latrodectus can discover the username of an infected host.5
enterprise T1529 System Shutdown/Reboot
Latrodectus has the ability to restart compromised hosts.5
enterprise T1204 User Execution -
enterprise T1204.001 Malicious Link Latrodectus has been executed through malicious links distributed in email campaigns.31
enterprise T1204.002 Malicious File Latrodectus has lured users into opening malicious email attachments for execution.1
enterprise T1497 Virtualization/Sandbox Evasion -
enterprise T1497.001 System Checks Latrodectus can determine if it is running in a virtualized environment by checking the OS version, checking the number of running processes, ensuring a 64-bit application is running on a 64-bit host, and checking if the host has a valid MAC address.352
enterprise T1102 Web Service Latrodectus has used Google Firebase to download malicious installation scripts.4
enterprise T1047 Windows Management Instrumentation Latrodectus has used WMI in malicious email infection chains to facilitate the installation of remotely-hosted files.52

Groups That Use This Software

ID Name References
G1037 TA577 3
G1038 TA578 32

References

  1. Abrams, L. (2024, April 30). New Latrodectus malware attacks use Microsoft, Cloudflare themes. Retrieved September 13, 2024. ↩↩↩↩↩↩↩↩↩

  2. Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  3. Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩

  4. Unit 42. (2024, June 25). 2024-06-25-IOCs-from-Latrodectus-activity. Retrieved September 13, 2024. ↩↩↩

  5. Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩