Overview

overview

10

Static

static

3

e-dekont_html.exe

windows7-x64

10

e-dekont_html.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2024, 16:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    e-dekont_html.exe

  • Size

    610KB

  • MD5

    66e196c15ec46d1e7526b1c48da1b72a

  • SHA1

    f9b2dc950a21c296aaf57a013c3f4e93f8ebbad2

  • SHA256

    8c5c6b99a06119e1064bfcf3f53cc66150751c0969dc37dc3603eef5535a8af9

  • SHA512

    f8d8241d5af76033ba83caff888d325285110356b8e35175260a912cf416670465d218d7c550b9f15cc969bc2f53381cb8e41dd4f9a859cae65e4df600b6f851

  • SSDEEP

    12288:yRfHhxVzsP5wzyNwv5gs3MjeNPq0wKrCHrT3GQzRVPUYvV3L2dXEg:yXxU5wzaktc4PEWCHfGQzbPfvFydXEg

Score
10/10
agentteslaevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 2 IoCs
    evasiontrojan
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e-dekont_html.exe
    "C:\Users\Admin\AppData\Local\Temp\e-dekont_html.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4300
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3520
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:4412
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3930.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:1060
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • UAC bypass
        • Windows security bypass
        • Checks computer location settings
        • Executes dropped EXE
        • Windows security modification
        • Checks whether UAC is enabled
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1284
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3016
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4996
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
          4⤵
            PID:4052

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_04rtta2e.uxp.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\tmp3930.tmp.bat
            Filesize

            151B

            MD5

            54b53e06b60aba742442254a4e35e039

            SHA1

            409431326e72f2d065f0cdfe9c1a9313b364385b

            SHA256

            0d2456619d67d6f6abf21a518a1caff12d3770b915797cf7a00741600f9df2c2

            SHA512

            4f4fa57d583adbaf21c6f8c906c8e9067e3ce724d6bd3d171d7228283ff015cc08afe78fa09685cba5c083caaf59d89ed87e464631061688ed00301ead6dba91

            Download Submit

          • C:\Users\Admin\AppData\Roaming\svchost.exe
            Filesize

            610KB

            MD5

            66e196c15ec46d1e7526b1c48da1b72a

            SHA1

            f9b2dc950a21c296aaf57a013c3f4e93f8ebbad2

            SHA256

            8c5c6b99a06119e1064bfcf3f53cc66150751c0969dc37dc3603eef5535a8af9

            SHA512

            f8d8241d5af76033ba83caff888d325285110356b8e35175260a912cf416670465d218d7c550b9f15cc969bc2f53381cb8e41dd4f9a859cae65e4df600b6f851

            Download Submit

          • memory/1284-35-0x00007FFD541D0000-0x00007FFD54C91000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/1284-14-0x00007FFD541D0000-0x00007FFD54C91000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3016-34-0x00007FFD541D0000-0x00007FFD54C91000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/3016-16-0x000001824DDA0000-0x000001824DDC2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/3016-29-0x000001824DBF0000-0x000001824DC00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3016-30-0x000001824DBF0000-0x000001824DC00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3016-17-0x00007FFD541D0000-0x00007FFD54C91000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4300-0-0x0000015ED7650000-0x0000015ED765C000-memory.dmp

            Filesize

            48KB

            Download

          • memory/4300-4-0x0000015EF2B10000-0x0000015EF2BA4000-memory.dmp

            Filesize

            592KB

            Download

          • memory/4300-2-0x0000015ED7A90000-0x0000015ED7AA0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4300-1-0x00007FFD554F0000-0x00007FFD55FB1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4300-10-0x00007FFD554F0000-0x00007FFD55FB1000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/4300-3-0x0000015ED7A90000-0x0000015ED7AA0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4996-31-0x0000000005780000-0x00000000057E6000-memory.dmp

            Filesize

            408KB

            Download

          • memory/4996-15-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

            Download

          • memory/4996-28-0x0000000074F70000-0x0000000075720000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4996-27-0x0000000005C30000-0x00000000061D4000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/4996-36-0x0000000006540000-0x0000000006590000-memory.dmp

            Filesize

            320KB

            Download

          • memory/4996-37-0x0000000006630000-0x00000000066C2000-memory.dmp

            Filesize

            584KB

            Download

          • memory/4996-38-0x00000000065C0000-0x00000000065CA000-memory.dmp

            Filesize

            40KB

            Download

          • memory/4996-39-0x0000000074F70000-0x0000000075720000-memory.dmp

            Filesize

            7.7MB

            Download