Analysis
-
max time kernel
90s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:18
Static task
static1
Behavioral task
behavioral1
Sample
Dekont.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Dekont.exe
Resource
win10v2004-20220414-en
General
-
Target
Dekont.exe
-
Size
1.0MB
-
MD5
1ba7ee7b1f0e03c2b63e828b4eb1158e
-
SHA1
bca0140b2bac77017b47676845ca97144c230ffa
-
SHA256
ac42965215afb055c4135cc87288be3f2aaff848972634fbaed4c365e112af43
-
SHA512
5d61af74c8b3ae2e307a1909b7d774f72d16c3db66e9f865b239d4ea1b4d743b205fb2239be7608e705606275c94eb96766d278bfc8079257a5b3dcb9309650b
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Dekont.exedescription pid process target process PID 4972 set thread context of 1392 4972 Dekont.exe Dekont.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Dekont.exePowershell.exepowershell.exepid process 4972 Dekont.exe 4972 Dekont.exe 1132 Powershell.exe 1132 Powershell.exe 4944 powershell.exe 4944 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Dekont.exePowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4972 Dekont.exe Token: SeDebugPrivilege 1132 Powershell.exe Token: SeDebugPrivilege 4944 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Dekont.exeDekont.execmd.exedescription pid process target process PID 4972 wrote to memory of 1392 4972 Dekont.exe Dekont.exe PID 4972 wrote to memory of 1392 4972 Dekont.exe Dekont.exe PID 4972 wrote to memory of 1392 4972 Dekont.exe Dekont.exe PID 4972 wrote to memory of 1392 4972 Dekont.exe Dekont.exe PID 4972 wrote to memory of 1392 4972 Dekont.exe Dekont.exe PID 4972 wrote to memory of 1392 4972 Dekont.exe Dekont.exe PID 4972 wrote to memory of 1392 4972 Dekont.exe Dekont.exe PID 4972 wrote to memory of 1392 4972 Dekont.exe Dekont.exe PID 4972 wrote to memory of 1132 4972 Dekont.exe Powershell.exe PID 4972 wrote to memory of 1132 4972 Dekont.exe Powershell.exe PID 4972 wrote to memory of 1132 4972 Dekont.exe Powershell.exe PID 1392 wrote to memory of 1196 1392 Dekont.exe cmd.exe PID 1392 wrote to memory of 1196 1392 Dekont.exe cmd.exe PID 1392 wrote to memory of 1196 1392 Dekont.exe cmd.exe PID 1196 wrote to memory of 4944 1196 cmd.exe powershell.exe PID 1196 wrote to memory of 4944 1196 cmd.exe powershell.exe PID 1196 wrote to memory of 4944 1196 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dekont.exe"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Dekont.exe"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Dekont.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Dekont.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dekont.exe.logFilesize
1KB
MD564db62f1fcd6f05a3298e223fe336792
SHA1c71bec9b3dbb6ec42e03ea82a9de0ad85ddbe54e
SHA25648e2648284e19b36808a8979cfd32e0e272bc52446854784328343912c808989
SHA512222caa4f30f905b008651506122d7b1c4119277d9cdb69aa3bf3ea911285f94176f257d9f76d4a5097b501d097910e1fea78eaaab9b00543e16b573fba618228
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD58ef3408a69c8d8d355d01fec045fc466
SHA1902571f67e8098a380fbb4c94da004c44c716d6d
SHA256c5d6dab8e30b6ec09130f138a5ab61ecfba811d954b68ff58f51753c0932a371
SHA512b1e9eac3c765d7aa6b1b95376066bd19e2a112e3d21b09c9bdf18775488cefc0ebba8dd6a11f1fbde40926c39559e75de5b76ad7c815902b032abcb49c1d55a0
-
memory/1132-154-0x0000000007F80000-0x0000000007F9A000-memory.dmpFilesize
104KB
-
memory/1132-146-0x0000000007930000-0x0000000007962000-memory.dmpFilesize
200KB
-
memory/1132-147-0x0000000071440000-0x000000007148C000-memory.dmpFilesize
304KB
-
memory/1132-157-0x0000000007F60000-0x0000000007F68000-memory.dmpFilesize
32KB
-
memory/1132-148-0x0000000006EC0000-0x0000000006EDE000-memory.dmpFilesize
120KB
-
memory/1132-144-0x0000000006180000-0x00000000061E6000-memory.dmpFilesize
408KB
-
memory/1132-139-0x0000000000000000-mapping.dmp
-
memory/1132-153-0x0000000007E70000-0x0000000007E7E000-memory.dmpFilesize
56KB
-
memory/1132-141-0x0000000005380000-0x00000000053B6000-memory.dmpFilesize
216KB
-
memory/1132-142-0x0000000005A50000-0x0000000006078000-memory.dmpFilesize
6.2MB
-
memory/1132-143-0x0000000005950000-0x0000000005972000-memory.dmpFilesize
136KB
-
memory/1132-149-0x00000000082A0000-0x000000000891A000-memory.dmpFilesize
6.5MB
-
memory/1132-145-0x0000000006930000-0x000000000694E000-memory.dmpFilesize
120KB
-
memory/1132-150-0x0000000007C40000-0x0000000007C5A000-memory.dmpFilesize
104KB
-
memory/1132-152-0x0000000007EB0000-0x0000000007F46000-memory.dmpFilesize
600KB
-
memory/1132-151-0x0000000007CA0000-0x0000000007CAA000-memory.dmpFilesize
40KB
-
memory/1196-155-0x0000000000000000-mapping.dmp
-
memory/1392-137-0x0000000000000000-mapping.dmp
-
memory/1392-140-0x0000000004ED0000-0x0000000004F6C000-memory.dmpFilesize
624KB
-
memory/1392-138-0x0000000000400000-0x00000000004C4000-memory.dmpFilesize
784KB
-
memory/4944-158-0x0000000000000000-mapping.dmp
-
memory/4944-159-0x0000000006550000-0x0000000006572000-memory.dmpFilesize
136KB
-
memory/4972-134-0x00000000079E0000-0x0000000007A56000-memory.dmpFilesize
472KB
-
memory/4972-135-0x00000000059B0000-0x00000000059CE000-memory.dmpFilesize
120KB
-
memory/4972-130-0x0000000000A80000-0x0000000000B8A000-memory.dmpFilesize
1.0MB
-
memory/4972-133-0x00000000030D0000-0x00000000030DA000-memory.dmpFilesize
40KB
-
memory/4972-136-0x0000000007BA0000-0x0000000007C06000-memory.dmpFilesize
408KB
-
memory/4972-132-0x0000000005450000-0x00000000054E2000-memory.dmpFilesize
584KB
-
memory/4972-131-0x0000000005A00000-0x0000000005FA4000-memory.dmpFilesize
5.6MB