Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09-05-2024 01:37
General
-
Target
SpyderCrypter.exe
-
Size
4.8MB
-
MD5
b3fb79184d1097420fb68b0240df9660
-
SHA1
60fcb2b85867b247bb5c622f121e4ab208c7da9c
-
SHA256
8babb9a5318d0b2fa43d6c18e91a23a70de547243db91f866e50bb2ff1b7db8b
-
SHA512
130ecef6b8d4418784dafa341277b214693c0d1849e6cf04a87193eb413b3ae0cef7eeb3124494a8bca33ffb2d1b27f875adeadbae1aea3d2ff767710471807e
-
SSDEEP
98304:FYh322d2m5YhkvxW/gGfoq8Np9qAX7z3z9CW6dwFdkyRYq/:FYhGy2tqvpoT8NvzJTp/
Malware Config
Extracted
gozi
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
AgentTesla payload 1 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\SpyderCrypter.exe"C:\Users\Admin\AppData\Local\Temp\SpyderCrypter.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SpyderResources.exe"C:\Users\Admin\AppData\Local\Temp\SpyderResources.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\jackpear63605335.vbs" /f4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\jackpear63605335.vbs6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN BraveUpdateScheduler_QMyk9gHxWJYAojiqe050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpnidm\QMyk9gHxWJYAojiqe050MX.exe" /RL HIGHEST /IT4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN BraveUpdateScheduler_QMyk9gHxWJYAojiqe050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpnidm\QMyk9gHxWJYAojiqe050MX.exe" /RL HIGHEST /IT5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\e24xjg22.exe"C:\Users\Admin\AppData\Local\Temp\e24xjg22.exe" explorer.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
Filesize
8KB
MD538a0dfffc39ddd5d1524ad927e9bf9d4
SHA1b11170a3a4617aa4a9f2a14f930b3c642dc53aff
SHA256649182fe313bab5acc29c7e1091025377eac80b8aa19777123db0702c96e0220
SHA512860c09df43fd5567389af54ae8bbe79fa78851038d33ccc3112626cb5ff4f6487958cd437935e822dd17993e015e1e234976bd343a9d534bd731405ff21c6fb4
-
Filesize
1.4MB
MD56f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA25670e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b
-
Filesize
11KB
MD5cc132ca7e1cf77db1a3e737260fcf14b
SHA1f6058656d44e95c23071251b278bc779a88083da
SHA2564c62d4e150f91dc3fdd1f29c955763c52f357045b1a2edf98ac272631dfdb210
SHA51252e64fdf7acf08525ddb352b0dd0b6ca3df8d8f13fa09dcd31c270c4e2040f2361c04ba56915cd05539f581df712562537239fbc942131cc725502af6d010fee
-
Filesize
129KB
MD5e1db6db8f38d42dd17579a12c1c805d8
SHA129a34e85e8fcebeff6d924acf88a7798984a574f
SHA25693a1acf6815e79ce2809bd3045dfca5ff39ee49b4c433f73ecaa79ae23842ded
SHA5128793813c770c4684c46eb3a4c0ff4cf58f4a61a1fbc4f57eebeeb37d4e3166038ce8d12d9a04f625aab6c916583142583d9f90ed1e19107b5ddacecb6d74e04b
-
Filesize
124KB
MD5e898826598a138f86f2aa80c0830707a
SHA11e912a5671f7786cc077f83146a0484e5a78729c
SHA256df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA5126827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb
-
Filesize
171B
MD5a34267102c21aff46aecc85598924544
SHA177268af47c6a4b9c6be7f7487b2c9b233d49d435
SHA256eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44
SHA5125d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3
-
Filesize
331B
MD5aac67bf7948a883cf51a9425609e878f
SHA1a25cdc1a816c36bb869e4dc3228ca3b36c9c9727
SHA25632acf4760337cf94d02d593ffa2c0e9a171532d398071f5989c9e8516104dc65
SHA512b9e8723fcb576ed9294bf658b14223ad4cb78412d72a6e3143b3958d338e599dca71fce0525aefffe2bc79c0c3a99f9a6ebad07408d382aa6897ae548835a089
-
Filesize
293B
MD5b076b6fbfee7292a0bb80cb905b2a8c7
SHA1965fe228922457501845284accf6bd764ea1e7b2
SHA256c43b739fbff4d5b6f5ae6d6a95711d096b4cc6fc60f7d798ab81750e406ce9a8
SHA5124501db353ce35146d7fd19c28d39586f524264e8086fcfc30077fffd39878e10b5fc36a434a65b9d4e164eb7a2fe1d5c3048f173b4a13fc8f813645227841a12
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
329B
MD57d92382a0ec25e258b17027f908f4b0a
SHA1bc583428f529abb7fcfeac16ef07c6b190bb74d9
SHA25602329cc2444ec1604e6c772679258bdf204164623a271d8e53ed87000f8600ad
SHA512ed8bec142cceea12622ae2705c177d7791daa76aa6995ec9c41a682d744ad5ea5fca7ef63e59b4f41404c496cf932e287450a9edb81a1423e27e9b6f43d4704a
-
Filesize
289B
MD5d019b56bf0a134d07ea49f98965459a7
SHA1c2982c8f5bf1540ba2d81b819d736bb33e5fce8e
SHA2568c4145074cdde5be847bf62163dff970284b0c5e527934fd002ab328a35acfbf
SHA5125c156a3bdc64724769e77d47c5cfb9b5c4adfd3f87448ab524c3f31f5babdd57f83e567a52bff39b020a9ff622aff05b6954d0926bb3eeb2f665b8d4f2e673e6
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
48KB
MD5bd875b47a2ceacd49fe231d82d39a176
SHA13d62bfb961ef35a4c6cadda84d01c4f7c09e50a1
SHA25693cc7eb7fe668e5a1a29a33b9dcc39664ffcad6265b3bba2ee033aec1420b428
SHA512a78ca6cb6cdbb5bb7e35f8855ae1afdd23626c6aa6cb9dcd2acf56bdd876cf6a4c9dfbfc109665537f956de82b1c391cf4f77ed7e66b6db68e69c2ac2fcd458f
-
Filesize
960KB
-
Filesize
120KB
-
Filesize
40KB
-
Filesize
240KB
-
Filesize
960KB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
132KB
-
Filesize
424KB
-
Filesize
12.0MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
320KB
-
Filesize
12.6MB
-
Filesize
48KB
-
Filesize
136KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
408KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
472KB
-
Filesize
712KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
10.0MB
-
Filesize
10.0MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
960KB
-
Filesize
704KB
-
Filesize
960KB
-
Filesize
2.1MB
-
Filesize
10.0MB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
10.0MB