File name:

Abantes.exe

Full analysis: https://app.any.run/tasks/53c469c1-3b0f-4900-8bcb-a3f86e305fa6
Verdict: Malicious activity
Analysis date: April 21, 2024, 16:00:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

CD2E58136D3049E9BE40AE29F9250C93

SHA1:

E97BEB8B87D130E5C5745981E3614ED6AA3CAAE3

SHA256:

DAC4B5511343CF863832E38886AF8A3E1D55529648314EB02CC21FA3979F6419

SSDEEP:

98304:sfVayUb+JmNyVQFWSEtVRMUx+JmNyVQFWSEtVRS+JmNyVQFWSEtVRvJ4tw4A7:xklk6k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Abantes.exe (PID: 548)
      • cmd.exe (PID: 3808)

    • UAC/LUA settings modification

      • Abantes.exe (PID: 548)

    • Changes image file execution options

      • Abantes.exe (PID: 548)

    • Changes the login/logoff helper path in the registry

      • Abantes.exe (PID: 548)

    • Deletes shadow copies

      • cmd.exe (PID: 3808)

    • Steals credentials from Web Browsers

      • taskhost.exe (PID: 3936)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Abantes.exe (PID: 548)
      • cmd.exe (PID: 3808)

    • The process creates files with name similar to system file names

      • Abantes.exe (PID: 548)

    • Executable content was dropped or overwritten

      • Abantes.exe (PID: 548)
      • cmd.exe (PID: 3808)

    • Starts CMD.EXE for commands execution

      • Abantes.exe (PID: 548)

    • Executing commands from a ".bat" file

      • Abantes.exe (PID: 548)

    • Found strings related to reading or modifying Windows Defender settings

      • Abantes.exe (PID: 548)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 3808)

    • Uses WMIC.EXE to obtain user accounts information

      • cmd.exe (PID: 3808)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 3808)

    • Reads the Internet Settings

      • WMIC.exe (PID: 2576)
      • Abantes.exe (PID: 548)
      • taskhost.exe (PID: 3936)
      • sipnotify.exe (PID: 3724)
      • WMIC.exe (PID: 1408)
      • Abantes.exe (PID: 4048)

    • Uses NETSH.EXE to change the status of the firewall

      • cmd.exe (PID: 3808)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 3808)

    • Executes as Windows Service

      • VSSVC.exe (PID: 980)
      • taskhost.exe (PID: 3936)
      • EOSNotify.exe (PID: 1424)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3808)

    • Reads security settings of Internet Explorer

      • Abantes.exe (PID: 548)
      • Abantes.exe (PID: 4048)

    • The system shut down or reboot

      • Abantes.exe (PID: 548)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 2588)
      • sipnotify.exe (PID: 3724)
      • Abantes.exe (PID: 4048)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 3724)

    • Reads Internet Explorer settings

      • WinMail.exe (PID: 2892)

  • INFO

    • Reads the computer name

      • Abantes.exe (PID: 548)
      • WinMail.exe (PID: 2892)
      • Abantes.exe (PID: 4048)
      • Rules.exe (PID: 3252)
      • IMEKLMG.EXE (PID: 3832)
      • wmpnscfg.exe (PID: 2836)
      • wmpnscfg.exe (PID: 3768)
      • IFEO.exe (PID: 2488)
      • IMEKLMG.EXE (PID: 3868)

    • Checks supported languages

      • Abantes.exe (PID: 548)
      • Rules.exe (PID: 3252)
      • WinMail.exe (PID: 2892)
      • Abantes.exe (PID: 4048)
      • IMEKLMG.EXE (PID: 3832)
      • wmpnscfg.exe (PID: 2836)
      • wmpnscfg.exe (PID: 3768)
      • IFEO.exe (PID: 2488)
      • IMEKLMG.EXE (PID: 3868)

    • Create files in a temporary directory

      • Abantes.exe (PID: 548)

    • Reads the machine GUID from the registry

      • Abantes.exe (PID: 548)
      • Abantes.exe (PID: 4048)
      • Rules.exe (PID: 3252)
      • WinMail.exe (PID: 2892)

    • Process checks whether UAC notifications are on

      • Abantes.exe (PID: 548)
      • IMEKLMG.EXE (PID: 3868)
      • IMEKLMG.EXE (PID: 3832)

    • Reads mouse settings

      • Abantes.exe (PID: 548)

    • Manual execution by a user

      • WinMail.exe (PID: 2892)
      • IMEKLMG.EXE (PID: 3868)
      • IMEKLMG.EXE (PID: 3832)
      • IFEO.exe (PID: 2488)
      • wmpnscfg.exe (PID: 2836)
      • wmpnscfg.exe (PID: 3768)
      • taskmgr.exe (PID: 3136)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 3724)

    • Reads the software policy settings

      • sipnotify.exe (PID: 3724)

    • Creates files or folders in the user directory

      • WinMail.exe (PID: 2892)
      • Abantes.exe (PID: 4048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:05:23 17:04:16+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 2820096
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x2b274e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.163
ProductVersionNumber: 2.0.0.163
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Abantes Trojan
CompanyName: -
FileDescription: Abantes
FileVersion: 2.0.0.163
InternalName: Abantes.exe
LegalCopyright: Copyright 2018
LegalTrademarks: -
OriginalFileName: Abantes.exe
ProductName: Abantes
ProductVersion: 2.0.0.163
AssemblyVersion: 2.0.0.163
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
41
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start abantes.exe cmd.exe takeown.exe no specs icacls.exe no specs takeown.exe no specs icacls.exe no specs takeown.exe no specs takeown.exe no specs takeown.exe no specs takeown.exe no specs takeown.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs wmic.exe no specs wmic.exe no specs netsh.exe no specs vssadmin.exe no specs vssvc.exe no specs taskkill.exe no specs timeout.exe no specs timeout.exe no specs shutdown.exe no specs Profile Notification Host no specs taskhost.exe ctfmon.exe no specs sipnotify.exe winmail.exe no specs abantes.exe no specs rules.exe no specs imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs taskmgr.exe no specs eosnotify.exe no specs Thumbnail Cache Out of Proc Server no specs ifeo.exe no specs abantes.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Users\admin\AppData\Local\Temp\Abantes.exe" C:\Users\admin\AppData\Local\Temp\Abantes.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Abantes
Exit code:
1073807364
Version:
2.0.0.163
Modules
Images
c:\users\admin\appdata\local\temp\abantes.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
572takeown /f "C:\Windows\en-US" /r /d yC:\Windows\System32\takeown.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Takes ownership of a file
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\takeown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
668"C:\Users\admin\AppData\Local\Temp\Abantes.exe" C:\Users\admin\AppData\Local\Temp\Abantes.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Abantes
Exit code:
3221226540
Version:
2.0.0.163
Modules
Images
c:\users\admin\appdata\local\temp\abantes.exe
c:\windows\system32\ntdll.dll
896takeown /f HelpPane.exeC:\Windows\System32\takeown.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Takes ownership of a file
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\takeown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
900"C:\Windows\System32\shutdown.exe" /l /fC:\Windows\System32\shutdown.exe—Abantes.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Shutdown and Annotation Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\shutdown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
980C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1408wmic useraccount where name='admin' rename 'Abantes Was Here'C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1424C:\Windows\system32\EOSNotify.exe C:\Windows\System32\EOSNotify.exe—services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
EOS Notification
Exit code:
0
Version:
6.1.7601.24544 (win7sp1_ldr_escrow.191230-1647)
Modules
Images
c:\windows\system32\eosnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1556icacls HelpPane.exe /granted admin:FC:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
2072icacls "C:\Windows\en-US" /granted admin:F /T /CC:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
Total events
8 811
Read events
8 637
Write events
161
Delete events
13

Modification events

(PID) Process:(548) Abantes.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:WallpaperStyle
Value:
2
(PID) Process:(548) Abantes.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:TileWallpaper
Value:
0
(PID) Process:(548) Abantes.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:legalnoticecaption
Value:
Welcome To Hell
(PID) Process:(548) Abantes.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:legalnoticetext
Value:
This Computer has been Infected by the Abantes Trojan. Hope You Enjoy.
(PID) Process:(548) Abantes.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoControlPanel
Value:
1
(PID) Process:(548) Abantes.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:AutoRestartShell
Value:
0
(PID) Process:(548) Abantes.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Userinit
Value:
C:\Windows\System32\userinit.exe, C:\Windows\Defender\Abantes.exe
(PID) Process:(548) Abantes.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(548) Abantes.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableTaskMgr
Value:
1
(PID) Process:(548) Abantes.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe
Operation:writeName:Debugger
Value:
C:\Windows\Defender\IFEO.exe
Executable files
10
Suspicious files
33
Text files
9
Unknown types
7

Dropped files

PID
Process
Filename
Type
548Abantes.exeC:\Users\admin\AppData\Local\Temp\wallpaper.bmp —
MD5:—
SHA256:—
548Abantes.exeC:\Windows\Defender\logonOverwrite.battext
MD5:BD0EA10E01862B4ACC74371B340600D0
SHA256:3359C3F847AF127E61D9857FD1F6D6C0AA50FC6ADDEED302513A651C04A28720
548Abantes.exeC:\Windows\Defender\LogonUIStart.exeexecutable
MD5:B131EEC92EA7D74FBA7A5D5895045E5D
SHA256:6500506FC7441CBD1B944D62B7E4B4F8759D93BE3B97900420B0E57CCB14656B
548Abantes.exeC:\Windows\Defender\explorer.exe.muiexecutable
MD5:39F1A6A8B713FCF30AFC03EA3C936F85
SHA256:B69B61675531060D350A795A53568CCF19A146060CEBB659EBC658A0E8B27FC9
548Abantes.exeC:\Windows\Defender\LogonUi.exeexecutable
MD5:9E61E83B1C53A8DF4A72BB5CE5A83EBD
SHA256:49876F744F58FA0665F902FB2761695C1EEE9F557299DDD9094C77EFE15CD0BA
2892WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\edb.chkbinary
MD5:FDA68760ED7547A701169AEEFAC62B34
SHA256:75E90B677C16829EE1789C378AA6775FD201999ABB4DB9474046078F016A40E2
548Abantes.exeC:\Windows\Defender\Payloads.dllexecutable
MD5:1267609A5F26696613050A2DE89FE470
SHA256:D6E77BC9B31AB9CEFE74C688349545908A633D0E09B80FAAECEF837565775B8E
548Abantes.exeC:\Windows\Defender\cursor.curbinary
MD5:F45D84E471C87561676942F31167B952
SHA256:B01930E8CFC1ECC9E2F3F7930D0999B32C928351BECB9ACEC227079730F466A6
2892WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStoreedb
MD5:A10AEA8300876F7B06CB8FEF0A9CF9DC
SHA256:5B2F716BE3BFBD0BB072407BABD91C2F26CDEAA9FDB3EFA9B0DB09A08E1C04B5
548Abantes.exeC:\Windows\Defender\Rules.exeexecutable
MD5:A284FBA14CF7FA169CF0AEB86C65F30F
SHA256:AA783A55F119224D8A0A366E609142DE4DAB1EC09EA7D7CD470099FF41D3BAF0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3724
sipnotify.exe
HEAD
200
23.197.138.118:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133581924798320000
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3724
sipnotify.exe
23.197.138.118:80
query.prod.cms.rt.microsoft.com
Akamai International B.V.
US
unknown

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 23.197.138.118
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Abantes.exe