Malware Analysis Report

2024-10-19 08:46

Sample ID 220521-pgyc1saecr
Target a9d59ec565a4366c28f42e00f76f2c0d795be7be6aa937e64ed3feab5328174b
SHA256 a9d59ec565a4366c28f42e00f76f2c0d795be7be6aa937e64ed3feab5328174b
Tags
masslogger collection ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a9d59ec565a4366c28f42e00f76f2c0d795be7be6aa937e64ed3feab5328174b

Threat Level: Known bad

The file a9d59ec565a4366c28f42e00f76f2c0d795be7be6aa937e64ed3feab5328174b was found to be: Known bad.

Malicious Activity Summary

masslogger collection ransomware spyware stealer

MassLogger

MassLogger log file

Reads user/profile data of web browsers

Deletes itself

Checks computer location settings

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Suspicious behavior: EnumeratesProcesses

outlook_office_path

outlook_win_path

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-21 12:18

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-21 12:18

Reported

2022-05-21 12:33

Platform

win7-20220414-en

Max time kernel

57s

Max time network

58s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"

Signatures

MassLogger

stealer spyware masslogger

MassLogger log file

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1336 set thread context of 988 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1336 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 1912 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 1336 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
PID 1336 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
PID 1336 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
PID 1336 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
PID 988 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\cmd.exe
PID 988 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\cmd.exe
PID 988 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\cmd.exe
PID 988 wrote to memory of 1888 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\cmd.exe
PID 1888 wrote to memory of 1452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1888 wrote to memory of 1452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1888 wrote to memory of 1452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1888 wrote to memory of 1452 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

outlook_office_path

Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A

outlook_win_path

Description Indicator Process Target
Key queried \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Dekont.exe

"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"

C:\Users\Admin\AppData\Local\Temp\Dekont.exe

"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"

C:\Users\Admin\AppData\Local\Temp\Dekont.exe

"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe

"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'

C:\Windows\SysWOW64\cmd.exe

"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Dekont.exe' & exit

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Dekont.exe'

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 52.20.78.240:80 api.ipify.org tcp
US 8.8.8.8:53 mail.nartaccess.com udp

Files

memory/1336-54-0x0000000000880000-0x000000000098A000-memory.dmp

memory/1336-55-0x0000000074B51000-0x0000000074B53000-memory.dmp

memory/1336-56-0x00000000007B0000-0x000000000086C000-memory.dmp

memory/988-57-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/988-58-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/988-60-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/988-61-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/988-62-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/988-63-0x00000000004BF8CE-mapping.dmp

memory/988-66-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/988-68-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/2020-65-0x0000000000000000-mapping.dmp

memory/988-70-0x00000000022F0000-0x0000000002368000-memory.dmp

memory/2020-72-0x000000006FA70000-0x000000007001B000-memory.dmp

memory/988-73-0x00000000005B5000-0x00000000005C6000-memory.dmp

memory/988-74-0x0000000000850000-0x0000000000864000-memory.dmp

memory/1888-75-0x0000000000000000-mapping.dmp

memory/1452-76-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 aef5dbb4bf2efedb9561b6266960f3e5
SHA1 99e5628ab9fca96abfa92df12e760ad7ffdc1038
SHA256 ce0807429c279525d2348707ad7cc40898f02aea691fcbdd6ff708d0e58b9e47
SHA512 4449bbc136362ce10640a498ea5eb6ab9b424c825015750b7ef5fe1709a3b372240bb40629260525bc3ef32141c4371bc1c22195249f31ddad8a4fbc709bbaf1

memory/1452-79-0x0000000072E40000-0x00000000733EB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-21 12:18

Reported

2022-05-21 12:33

Platform

win10v2004-20220414-en

Max time kernel

90s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"

Signatures

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4972 set thread context of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4972 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 4972 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 4972 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 4972 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 4972 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 4972 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 4972 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 4972 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Users\Admin\AppData\Local\Temp\Dekont.exe
PID 4972 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
PID 4972 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
PID 4972 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
PID 1392 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\cmd.exe
PID 1392 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\Dekont.exe C:\Windows\SysWOW64\cmd.exe
PID 1196 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1196 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1196 wrote to memory of 4944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Dekont.exe

"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"

C:\Users\Admin\AppData\Local\Temp\Dekont.exe

"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe

"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'

C:\Windows\SysWOW64\cmd.exe

"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Dekont.exe' & exit

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\Dekont.exe'

Network

Country Destination Domain Proto
NL 104.110.191.140:80 tcp
BE 8.238.110.126:80 tcp

Files

memory/4972-130-0x0000000000A80000-0x0000000000B8A000-memory.dmp

memory/4972-131-0x0000000005A00000-0x0000000005FA4000-memory.dmp

memory/4972-132-0x0000000005450000-0x00000000054E2000-memory.dmp

memory/4972-133-0x00000000030D0000-0x00000000030DA000-memory.dmp

memory/4972-134-0x00000000079E0000-0x0000000007A56000-memory.dmp

memory/4972-135-0x00000000059B0000-0x00000000059CE000-memory.dmp

memory/4972-136-0x0000000007BA0000-0x0000000007C06000-memory.dmp

memory/1392-137-0x0000000000000000-mapping.dmp

memory/1392-138-0x0000000000400000-0x00000000004C4000-memory.dmp

memory/1132-139-0x0000000000000000-mapping.dmp

memory/1392-140-0x0000000004ED0000-0x0000000004F6C000-memory.dmp

memory/1132-141-0x0000000005380000-0x00000000053B6000-memory.dmp

memory/1132-142-0x0000000005A50000-0x0000000006078000-memory.dmp

memory/1132-143-0x0000000005950000-0x0000000005972000-memory.dmp

memory/1132-144-0x0000000006180000-0x00000000061E6000-memory.dmp

memory/1132-145-0x0000000006930000-0x000000000694E000-memory.dmp

memory/1132-146-0x0000000007930000-0x0000000007962000-memory.dmp

memory/1132-147-0x0000000071440000-0x000000007148C000-memory.dmp

memory/1132-148-0x0000000006EC0000-0x0000000006EDE000-memory.dmp

memory/1132-149-0x00000000082A0000-0x000000000891A000-memory.dmp

memory/1132-150-0x0000000007C40000-0x0000000007C5A000-memory.dmp

memory/1132-151-0x0000000007CA0000-0x0000000007CAA000-memory.dmp

memory/1132-152-0x0000000007EB0000-0x0000000007F46000-memory.dmp

memory/1132-153-0x0000000007E70000-0x0000000007E7E000-memory.dmp

memory/1132-154-0x0000000007F80000-0x0000000007F9A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Dekont.exe.log

MD5 64db62f1fcd6f05a3298e223fe336792
SHA1 c71bec9b3dbb6ec42e03ea82a9de0ad85ddbe54e
SHA256 48e2648284e19b36808a8979cfd32e0e272bc52446854784328343912c808989
SHA512 222caa4f30f905b008651506122d7b1c4119277d9cdb69aa3bf3ea911285f94176f257d9f76d4a5097b501d097910e1fea78eaaab9b00543e16b573fba618228

memory/1196-155-0x0000000000000000-mapping.dmp

memory/1132-157-0x0000000007F60000-0x0000000007F68000-memory.dmp

memory/4944-158-0x0000000000000000-mapping.dmp

memory/4944-159-0x0000000006550000-0x0000000006572000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 8ef3408a69c8d8d355d01fec045fc466
SHA1 902571f67e8098a380fbb4c94da004c44c716d6d
SHA256 c5d6dab8e30b6ec09130f138a5ab61ecfba811d954b68ff58f51753c0932a371
SHA512 b1e9eac3c765d7aa6b1b95376066bd19e2a112e3d21b09c9bdf18775488cefc0ebba8dd6a11f1fbde40926c39559e75de5b76ad7c815902b032abcb49c1d55a0

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3