Overview

overview

10

Static

static

7

SpyderCrypter.exe

windows7-x64

10

SpyderCrypter.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    50s
  • max time network
    36s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-06-2024 17:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SpyderCrypter.exe

  • Size

    4.8MB

  • MD5

    b3fb79184d1097420fb68b0240df9660

  • SHA1

    60fcb2b85867b247bb5c622f121e4ab208c7da9c

  • SHA256

    8babb9a5318d0b2fa43d6c18e91a23a70de547243db91f866e50bb2ff1b7db8b

  • SHA512

    130ecef6b8d4418784dafa341277b214693c0d1849e6cf04a87193eb413b3ae0cef7eeb3124494a8bca33ffb2d1b27f875adeadbae1aea3d2ff767710471807e

  • SSDEEP

    98304:FYh322d2m5YhkvxW/gGfoq8Np9qAX7z3z9CW6dwFdkyRYq/:FYhGy2tqvpoT8NvzJTp/

Score
10/10
agentteslaevasionkeyloggerspywarestealerthemidatrojan

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • AgentTesla payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SpyderCrypter.exe
    "C:\Users\Admin\AppData\Local\Temp\SpyderCrypter.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Users\Admin\AppData\Local\Temp\SpyderResources.exe
      "C:\Users\Admin\AppData\Local\Temp\SpyderResources.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3612
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\jackpear63605335.vbs" /f
        3⤵
        • Modifies registry class
        PID:3672
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
        3⤵
        • Modifies registry class
        PID:4388
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /C computerdefaults.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:720
        • C:\Windows\SysWOW64\ComputerDefaults.exe
          computerdefaults.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1676
          • C:\Windows\SysWOW64\wscript.exe
            "wscript.exe" C:\Users\Admin\AppData\Local\Temp\jackpear63605335.vbs
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:4796
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
              6⤵
                PID:4604
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN BraveUpdateScheduler_QMyk9gHxWJYAojiqe050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpnidm\QMyk9gHxWJYAojiqe050MX.exe" /RL HIGHEST /IT
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:748
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /SC ONLOGON /TN BraveUpdateScheduler_QMyk9gHxWJYAojiqe050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpnidm\QMyk9gHxWJYAojiqe050MX.exe" /RL HIGHEST /IT
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3076
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 2272
          3⤵
          • Program crash
          PID:2548
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3612 -ip 3612
      1⤵
        PID:4064
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
        1⤵
          PID:520

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Virtualization/Sandbox Evasion

        1
        T1497

        Credential Access

        Discovery

        Query Registry

        4
        T1012

        Virtualization/Sandbox Evasion

        1
        T1497

        System Information Discovery

        5
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Web Service

        1
        T1102

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
          Filesize

          28KB

          MD5

          8c9bad84a35d7dc762ba1ae096d58dde

          SHA1

          c511d10f0870e695e6b8c4baab6a6222d8719760

          SHA256

          664313e52458dac6690d56f35ff0de85c9153a67b605e71453933a4532b3c1b0

          SHA512

          c1bc5599d679c3a0bdd5c50a8893951782d3d03404b47f4495c35c72b07c0168d12c1619c76a2e72ace28ad57c7302fc27c873ee602bb5c5828505b84a9c1dcc

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\SpyderResources.exe
          Filesize

          11KB

          MD5

          cc132ca7e1cf77db1a3e737260fcf14b

          SHA1

          f6058656d44e95c23071251b278bc779a88083da

          SHA256

          4c62d4e150f91dc3fdd1f29c955763c52f357045b1a2edf98ac272631dfdb210

          SHA512

          52e64fdf7acf08525ddb352b0dd0b6ca3df8d8f13fa09dcd31c270c4e2040f2361c04ba56915cd05539f581df712562537239fbc942131cc725502af6d010fee

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\jackpear63605335.vbs
          Filesize

          171B

          MD5

          a34267102c21aff46aecc85598924544

          SHA1

          77268af47c6a4b9c6be7f7487b2c9b233d49d435

          SHA256

          eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44

          SHA512

          5d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3

          Download Submit
        • memory/3612-40-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3612-31-0x0000000004CC0000-0x0000000004CDA000-memory.dmp
          Filesize

          104KB

          Download
        • memory/3612-39-0x000000000BBE0000-0x000000000D123000-memory.dmp
          Filesize

          21.3MB

          Download
        • memory/3612-32-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3612-33-0x0000000000EA0000-0x0000000000EAA000-memory.dmp
          Filesize

          40KB

          Download
        • memory/3612-30-0x00000000002F0000-0x00000000002FA000-memory.dmp
          Filesize

          40KB

          Download
        • memory/3612-34-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-12-0x0000000000750000-0x000000000115C000-memory.dmp
          Filesize

          10.0MB

          Download
        • memory/4880-35-0x0000000000750000-0x000000000115C000-memory.dmp
          Filesize

          10.0MB

          Download
        • memory/4880-11-0x0000000000750000-0x000000000115C000-memory.dmp
          Filesize

          10.0MB

          Download
        • memory/4880-15-0x0000000005B70000-0x0000000005B7A000-memory.dmp
          Filesize

          40KB

          Download
        • memory/4880-16-0x0000000006770000-0x0000000006984000-memory.dmp
          Filesize

          2.1MB

          Download
        • memory/4880-17-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-18-0x00000000071A0000-0x0000000007250000-memory.dmp
          Filesize

          704KB

          Download
        • memory/4880-2-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-7-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-8-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-4-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-14-0x0000000005CB0000-0x0000000005D42000-memory.dmp
          Filesize

          584KB

          Download
        • memory/4880-5-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-13-0x00000000061C0000-0x0000000006764000-memory.dmp
          Filesize

          5.6MB

          Download
        • memory/4880-3-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-38-0x0000000075870000-0x0000000075871000-memory.dmp
          Filesize

          4KB

          Download
        • memory/4880-6-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-0-0x0000000000750000-0x000000000115C000-memory.dmp
          Filesize

          10.0MB

          Download
        • memory/4880-42-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-43-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-44-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-47-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-46-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-45-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-49-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-50-0x0000000075850000-0x0000000075940000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4880-1-0x0000000075870000-0x0000000075871000-memory.dmp
          Filesize

          4KB

          Download