Overview

overview

10

Static

static

1

dekont.exe

windows7_x64

10

dekont.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    88s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    12/04/2022, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dekont.exe
  • Size 234KB
  • Sample220412-phs5pabdap
  • SHA256 c767db1d9bb5f369f3a2d395412c98f71de29cf829800a2494a2c0dec8e4a57f
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dekont.exe
    "C:\Users\Admin\AppData\Local\Temp\dekont.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Users\Admin\AppData\Local\Temp\osqihihwa.exe
      C:\Users\Admin\AppData\Local\Temp\osqihihwa.exe C:\Users\Admin\AppData\Local\Temp\wxuluwqqid
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3220
      • C:\Users\Admin\AppData\Local\Temp\osqihihwa.exe
        C:\Users\Admin\AppData\Local\Temp\osqihihwa.exe C:\Users\Admin\AppData\Local\Temp\wxuluwqqid
        3⤵
          PID:2280

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          921ll2enr4lqqc
          • Path C:\Users\Admin\AppData\Local\Temp\921ll2enr4lqqc
          • Size 210KB
          • SHA256 35e9e61ea9076635b5a1ea7ab514be4c75dfc51d7e13bcfe0cfabfea527e1736
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          osqihihwa.exe
          • Path C:\Users\Admin\AppData\Local\Temp\osqihihwa.exe
          • Size 5KB
          • SHA256 3942faa031d8aef3c0a3e391c55b2238b2b9cf5d7a645bbd04e52b1b9b2cfff0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          osqihihwa.exe
          • Path C:\Users\Admin\AppData\Local\Temp\osqihihwa.exe
          • Size 5KB
          • SHA256 3942faa031d8aef3c0a3e391c55b2238b2b9cf5d7a645bbd04e52b1b9b2cfff0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          wxuluwqqid
          • Path C:\Users\Admin\AppData\Local\Temp\wxuluwqqid
          • Size 4KB
          • SHA256 c94d342f4013c0dcc0d639d359f503f3a440d28268559d4f6c6f56ebd8c993e3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download