Overview

overview

8

Static

static

DEKONT_P.EXE

windows7_x64

8

DEKONT_P.EXE

windows10_x64

8

Analysis

  • max time kernel
    21s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    21/09/2020, 13:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DEKONT_P.EXE
  • Size 875KB
  • Sample200921-rtmmbgdtn2
  • SHA256 09bdb0fb2e5689963f8375783abf0d87d2dbccc6a7ed8b03d7a53af29ab2c4d6
  • MD5 SHA1 SHA512
Score
8/10
spyware

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DEKONT_P.EXE
    "C:\Users\Admin\AppData\Local\Temp\DEKONT_P.EXE"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c A.exe /stext A.txt
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Users\Admin\AppData\Local\Temp\A.exe
        A.exe /stext A.txt
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1996
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c B.exe /stext B.txt
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1268
      • C:\Users\Admin\AppData\Local\Temp\B.exe
        B.exe /stext B.txt
        3⤵
        • Executes dropped EXE
        PID:984

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1672-0-0x000007FEF84F0000-0x000007FEF876A000-memory.dmp
        Download