Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
18/10/2024, 06:10
General
- Target Dekont-20241017-1100.00EFT-18901459.exe
- Size 478KB
- Sample241018-gw2d8a1fng
- SHA256 3bbeda749854caa304bb1e8b968971a7e84359f98105c9ef80d18033adcc2f09
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dekont-20241017-1100.00EFT-18901459.exe"C:\Users\Admin\AppData\Local\Temp\Dekont-20241017-1100.00EFT-18901459.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Dekont-20241017-1100.00EFT-18901459.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SKnsCk.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SKnsCk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1817.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\Dekont-20241017-1100.00EFT-18901459.exe"C:\Users\Admin\AppData\Local\Temp\Dekont-20241017-1100.00EFT-18901459.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Dekont-20241017-1100.00EFT-18901459.exe"C:\Users\Admin\AppData\Local\Temp\Dekont-20241017-1100.00EFT-18901459.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ukm5w23e.sii.ps1
tmp1817.tmp
memory/2400-4-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/2400-5-0x0000000005430000-0x000000000543A000-memory.dmp
memory/2400-6-0x0000000005540000-0x00000000055DC000-memory.dmp
memory/2400-7-0x0000000005530000-0x0000000005542000-memory.dmp
memory/2400-8-0x000000007539E000-0x000000007539F000-memory.dmp
memory/2400-9-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/2400-10-0x0000000006880000-0x00000000068DE000-memory.dmp
memory/2400-3-0x0000000005280000-0x0000000005312000-memory.dmp
memory/2400-2-0x0000000005830000-0x0000000005DD4000-memory.dmp
memory/2400-0-0x000000007539E000-0x000000007539F000-memory.dmp
memory/2400-48-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/2400-1-0x0000000000950000-0x00000000009CA000-memory.dmp
memory/2760-65-0x00000000079D0000-0x000000000804A000-memory.dmp
memory/2760-63-0x0000000006630000-0x000000000664E000-memory.dmp
memory/2760-24-0x0000000005A10000-0x0000000005A76000-memory.dmp
memory/2760-25-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/2760-23-0x00000000059A0000-0x0000000005A06000-memory.dmp
memory/2760-22-0x00000000050B0000-0x00000000050D2000-memory.dmp
memory/2760-89-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/2760-15-0x0000000002730000-0x0000000002766000-memory.dmp
memory/2760-16-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/2760-35-0x0000000005A80000-0x0000000005DD4000-memory.dmp
memory/2760-17-0x0000000005280000-0x00000000058A8000-memory.dmp
memory/2760-49-0x0000000006060000-0x000000000607E000-memory.dmp
memory/2760-50-0x00000000060F0000-0x000000000613C000-memory.dmp
memory/2760-80-0x00000000075B0000-0x00000000075BE000-memory.dmp
memory/2760-53-0x0000000075BF0000-0x0000000075C3C000-memory.dmp
memory/2760-52-0x0000000007050000-0x0000000007082000-memory.dmp
memory/2760-64-0x0000000007290000-0x0000000007333000-memory.dmp
memory/2760-78-0x0000000007600000-0x0000000007696000-memory.dmp
memory/2760-77-0x00000000073F0000-0x00000000073FA000-memory.dmp
memory/2760-67-0x0000000007380000-0x000000000739A000-memory.dmp
memory/2760-18-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/4728-66-0x0000000075BF0000-0x0000000075C3C000-memory.dmp
memory/4728-20-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/4728-79-0x0000000007510000-0x0000000007521000-memory.dmp
memory/4728-81-0x0000000007550000-0x0000000007564000-memory.dmp
memory/4728-82-0x0000000007650000-0x000000000766A000-memory.dmp
memory/4728-83-0x0000000007630000-0x0000000007638000-memory.dmp
memory/4728-90-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/4728-36-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/4728-19-0x0000000075390000-0x0000000075B40000-memory.dmp
memory/4964-51-0x00000000069D0000-0x0000000006A20000-memory.dmp
memory/4964-46-0x0000000000400000-0x000000000041E000-memory.dmp
memory/4964-91-0x0000000006CF0000-0x0000000006EB2000-memory.dmp