Analysis
-
max time kernel
23s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 13:54
Behavioral task
behavioral1
Sample
SpyderCrypter.exe
Resource
win10-20240404-en
General
-
Target
SpyderCrypter.exe
-
Size
4.8MB
-
MD5
b3fb79184d1097420fb68b0240df9660
-
SHA1
60fcb2b85867b247bb5c622f121e4ab208c7da9c
-
SHA256
8babb9a5318d0b2fa43d6c18e91a23a70de547243db91f866e50bb2ff1b7db8b
-
SHA512
130ecef6b8d4418784dafa341277b214693c0d1849e6cf04a87193eb413b3ae0cef7eeb3124494a8bca33ffb2d1b27f875adeadbae1aea3d2ff767710471807e
-
SSDEEP
98304:FYh322d2m5YhkvxW/gGfoq8Np9qAX7z3z9CW6dwFdkyRYq/:FYhGy2tqvpoT8NvzJTp/
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1052-17-0x0000000006190000-0x00000000063A4000-memory.dmp family_agenttesla -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
SpyderCrypter.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SpyderCrypter.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
SpyderCrypter.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SpyderCrypter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SpyderCrypter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SpyderCrypter.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation SpyderCrypter.exe -
Executes dropped EXE 1 IoCs
Processes:
SpyderResources.exepid process 5316 SpyderResources.exe -
Processes:
resource yara_rule behavioral2/memory/1052-11-0x0000000000DD0000-0x00000000017DC000-memory.dmp themida behavioral2/memory/1052-12-0x0000000000DD0000-0x00000000017DC000-memory.dmp themida -
Processes:
SpyderCrypter.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SpyderCrypter.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
Processes:
flow ioc 28 raw.githubusercontent.com 29 raw.githubusercontent.com 31 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5132 5316 WerFault.exe SpyderResources.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
SpyderCrypter.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SpyderCrypter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer SpyderCrypter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion SpyderCrypter.exe -
Modifies registry class 7 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\jackpear63605335.vbs" reg.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings\shell\open\command reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0" reg.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings\shell\open\command reg.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SpyderCrypter.exeSpyderResources.exedescription pid process Token: SeDebugPrivilege 1052 SpyderCrypter.exe Token: SeDebugPrivilege 5316 SpyderResources.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
SpyderCrypter.exeSpyderResources.execmd.exedescription pid process target process PID 1052 wrote to memory of 5316 1052 SpyderCrypter.exe SpyderResources.exe PID 1052 wrote to memory of 5316 1052 SpyderCrypter.exe SpyderResources.exe PID 1052 wrote to memory of 5316 1052 SpyderCrypter.exe SpyderResources.exe PID 5316 wrote to memory of 5488 5316 SpyderResources.exe reg.exe PID 5316 wrote to memory of 5488 5316 SpyderResources.exe reg.exe PID 5316 wrote to memory of 5488 5316 SpyderResources.exe reg.exe PID 5316 wrote to memory of 1584 5316 SpyderResources.exe reg.exe PID 5316 wrote to memory of 1584 5316 SpyderResources.exe reg.exe PID 5316 wrote to memory of 1584 5316 SpyderResources.exe reg.exe PID 5316 wrote to memory of 4988 5316 SpyderResources.exe cmd.exe PID 5316 wrote to memory of 4988 5316 SpyderResources.exe cmd.exe PID 5316 wrote to memory of 4988 5316 SpyderResources.exe cmd.exe PID 4988 wrote to memory of 4812 4988 cmd.exe ComputerDefaults.exe PID 4988 wrote to memory of 4812 4988 cmd.exe ComputerDefaults.exe PID 4988 wrote to memory of 4812 4988 cmd.exe ComputerDefaults.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpyderCrypter.exe"C:\Users\Admin\AppData\Local\Temp\SpyderCrypter.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SpyderResources.exe"C:\Users\Admin\AppData\Local\Temp\SpyderResources.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\jackpear63605335.vbs" /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe4⤵
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\jackpear63605335.vbs5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN BraveUpdateScheduler_QMyk9gHxWJYAojiqe050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpnidm\QMyk9gHxWJYAojiqe050MX.exe" /RL HIGHEST /IT3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN BraveUpdateScheduler_QMyk9gHxWJYAojiqe050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpnidm\QMyk9gHxWJYAojiqe050MX.exe" /RL HIGHEST /IT4⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 18483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5316 -ip 53161⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SpyderResources.exeFilesize
11KB
MD5cc132ca7e1cf77db1a3e737260fcf14b
SHA1f6058656d44e95c23071251b278bc779a88083da
SHA2564c62d4e150f91dc3fdd1f29c955763c52f357045b1a2edf98ac272631dfdb210
SHA51252e64fdf7acf08525ddb352b0dd0b6ca3df8d8f13fa09dcd31c270c4e2040f2361c04ba56915cd05539f581df712562537239fbc942131cc725502af6d010fee
-
C:\Users\Admin\AppData\Local\Temp\jackpear63605335.vbsFilesize
171B
MD5a34267102c21aff46aecc85598924544
SHA177268af47c6a4b9c6be7f7487b2c9b233d49d435
SHA256eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44
SHA5125d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3
-
memory/1052-20-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-11-0x0000000000DD0000-0x00000000017DC000-memory.dmpFilesize
10.0MB
-
memory/1052-4-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-21-0x0000000008F50000-0x0000000009000000-memory.dmpFilesize
704KB
-
memory/1052-6-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-7-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-8-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-2-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-12-0x0000000000DD0000-0x00000000017DC000-memory.dmpFilesize
10.0MB
-
memory/1052-13-0x0000000006470000-0x0000000006A14000-memory.dmpFilesize
5.6MB
-
memory/1052-14-0x0000000005E10000-0x0000000005EA2000-memory.dmpFilesize
584KB
-
memory/1052-16-0x0000000005DE0000-0x0000000005DEA000-memory.dmpFilesize
40KB
-
memory/1052-17-0x0000000006190000-0x00000000063A4000-memory.dmpFilesize
2.1MB
-
memory/1052-48-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-0-0x0000000000DD0000-0x00000000017DC000-memory.dmpFilesize
10.0MB
-
memory/1052-19-0x0000000077620000-0x0000000077621000-memory.dmpFilesize
4KB
-
memory/1052-5-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-3-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-18-0x0000000000DD0000-0x00000000017DC000-memory.dmpFilesize
10.0MB
-
memory/1052-46-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-40-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-1-0x0000000077620000-0x0000000077621000-memory.dmpFilesize
4KB
-
memory/1052-41-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-36-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-35-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/1052-42-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/5316-34-0x0000000004F50000-0x0000000004F6A000-memory.dmpFilesize
104KB
-
memory/5316-37-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/5316-39-0x0000000004F40000-0x0000000004F4A000-memory.dmpFilesize
40KB
-
memory/5316-38-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB
-
memory/5316-47-0x000000000BD10000-0x000000000D253000-memory.dmpFilesize
21.3MB
-
memory/5316-33-0x0000000000860000-0x000000000086A000-memory.dmpFilesize
40KB
-
memory/5316-49-0x0000000077600000-0x00000000776F0000-memory.dmpFilesize
960KB