Overview
overview
10Static
static
3E-dekont.exe
windows7-x64
10E-dekont.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Affringsmi...de.app
macos-10.15-amd64
1Analysis
-
max time kernel
136s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2024 10:19
Static task
static1
Behavioral task
behavioral1
Sample
E-dekont.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
E-dekont.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
Affringsmidlernes/Limidae/Skolebussen/megapode.app
Resource
macos-20231201-en
General
-
Target
E-dekont.exe
-
Size
403KB
-
MD5
534987dcfd26b334dc401fa5d501e23f
-
SHA1
d748436bfffa554c82247fb4d9a064c9a7e92e5a
-
SHA256
886ad48d3aaf6d23fb1a7625719853d95efd532c1d89e61aea2255234f8e7b2c
-
SHA512
1034b81dcd4f4baac0774ffb04090ff3fbbebbd44ba2338195196fec705048d10fd680785415eb97d504eb412e9d0a0272525ea070a99f2259e37a454872389d
-
SSDEEP
12288:ikvqcSBHXKI1olfHpy/qTnoxyMCuKqpcCoJE:GXKI2lB8qmNCCaE
Malware Config
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
E-dekont.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation E-dekont.exe -
Loads dropped DLL 8 IoCs
Processes:
E-dekont.exeE-dekont.exepid process 2100 E-dekont.exe 2100 E-dekont.exe 2100 E-dekont.exe 2100 E-dekont.exe 4472 E-dekont.exe 4472 E-dekont.exe 4472 E-dekont.exe 4472 E-dekont.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
E-dekont.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook E-dekont.exe Key opened \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook E-dekont.exe Key opened \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook E-dekont.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
E-dekont.exepid process 4472 E-dekont.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
E-dekont.exeE-dekont.exepid process 2100 E-dekont.exe 4472 E-dekont.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
E-dekont.exedescription pid process target process PID 2100 set thread context of 4472 2100 E-dekont.exe E-dekont.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
E-dekont.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 E-dekont.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString E-dekont.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1220 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
E-dekont.exepid process 4472 E-dekont.exe 4472 E-dekont.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
E-dekont.exepid process 2100 E-dekont.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
E-dekont.exeE-dekont.execmd.exedescription pid process target process PID 2100 wrote to memory of 4472 2100 E-dekont.exe E-dekont.exe PID 2100 wrote to memory of 4472 2100 E-dekont.exe E-dekont.exe PID 2100 wrote to memory of 4472 2100 E-dekont.exe E-dekont.exe PID 2100 wrote to memory of 4472 2100 E-dekont.exe E-dekont.exe PID 2100 wrote to memory of 4472 2100 E-dekont.exe E-dekont.exe PID 4472 wrote to memory of 2444 4472 E-dekont.exe cmd.exe PID 4472 wrote to memory of 2444 4472 E-dekont.exe cmd.exe PID 4472 wrote to memory of 2444 4472 E-dekont.exe cmd.exe PID 2444 wrote to memory of 1220 2444 cmd.exe timeout.exe PID 2444 wrote to memory of 1220 2444 cmd.exe timeout.exe PID 2444 wrote to memory of 1220 2444 cmd.exe timeout.exe -
outlook_office_path 1 IoCs
Processes:
E-dekont.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook E-dekont.exe -
outlook_win_path 1 IoCs
Processes:
E-dekont.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook E-dekont.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\E-dekont.exe"C:\Users\Admin\AppData\Local\Temp\E-dekont.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\E-dekont.exe"C:\Users\Admin\AppData\Local\Temp\E-dekont.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4472 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "E-dekont.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 34⤵
- Delays execution with timeout.exe
PID:1220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD59e682f1eb98a9d41468fc3e50f907635
SHA185e0ceca36f657ddf6547aa0744f0855a27527ee
SHA256830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d
SHA512230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed
-
Filesize
278KB
MD5b47b8c57cdc02b51ec8b321effa874cb
SHA1ee66ca4a282bfd6b349b38f74c6914d14a3ac2ff
SHA25609aaff224e5bfb8207da80c590622304699df74cf3fc6b8889981e875fc58b0c
SHA512b58b2f906099bea6bb10b3b41c88bf49f9052aa4c8878cc979c141b9d7e66e64afb30124c2e30aeef7348c597fb06f083027aba1fef7fcd185b04d9d7283b6be
-
Filesize
159KB
MD5a66e7473a1045772db8f948911f5081a
SHA1abd2734dba3b9c4cb8ac76959f70fb2973f9d016
SHA256e39083d124f4790616a78413049770220f36e523f4962f08978dde01f3d6cae8
SHA512b185922c81fa46416e6407c14fb30529daac6ba744d2f25305cde4b580b75985f0aba39051a729989b2988874e82b48257c744f9adecf675dad961acfda857f0
-
Filesize
81KB
MD57587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
Filesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
-
Filesize
9KB
MD542b064366f780c1f298fa3cb3aeae260
SHA15b0349db73c43f35227b252b9aa6555f5ede9015
SHA256c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab
SHA51250d8f4f7a3ff45d5854741e7c4153fa13ee1093bafbe9c2adc60712ed2fb505c9688dd420d75aaea1b696da46b6beccc232e41388bc2a16b1f9eea1832df1cd7
-
Filesize
6KB
MD5b55f7f1b17c39018910c23108f929082
SHA11601f1cc0d0d6bcf35799b7cd15550cd01556172
SHA256c4c6fe032f3cd8b31528d7b99661f85ee22cb78746aee98ec568431d4f5043f7
SHA512d652f2b09396ef7b9181996c4700b25840ceaa6c1c10080a55ce3db4c25d8d85f00a21e747f9d14a3374be4cdd4ea829a18d7de9b27b13b5e304447f3e9268fa