Analysis
- max time kernel
298s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
20/10/2026, 09:06
General
- Target Dekont.exe
- Size 1.2MB
- Sample261020-k2thcaxycy
- SHA256 38aa284ea16dbbd2189ec674eddea0ecb7210b6ffb0ec3b8979a64ebd3714821
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dekont.exe"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1652-844-0x00000000012F0000-0x0000000001336000-memory.dmp
memory/1652-845-0x0000000001960000-0x0000000001CAA000-memory.dmp
memory/1652-846-0x00000000012F0000-0x0000000001336000-memory.dmp
memory/1652-847-0x00000000012F0000-0x0000000001336000-memory.dmp
memory/2476-0-0x0000000000D80000-0x0000000000EC2000-memory.dmp
memory/2476-1-0x0000000005E90000-0x0000000006434000-memory.dmp
memory/2476-2-0x00000000058E0000-0x0000000005972000-memory.dmp
memory/2476-3-0x0000000005980000-0x0000000005A1C000-memory.dmp
memory/2476-4-0x0000000005BA0000-0x0000000005BB0000-memory.dmp
memory/2476-5-0x0000000005A20000-0x0000000005A94000-memory.dmp
memory/2476-21-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-29-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-91-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-97-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-95-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-93-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-89-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-87-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-85-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-83-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-81-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-79-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-78-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-75-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-71-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-69-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-65-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-63-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-59-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-57-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-55-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-53-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-51-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-49-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-45-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-43-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-41-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-39-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-37-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-35-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-33-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-31-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-27-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-25-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-23-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-19-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-17-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-73-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-15-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-67-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-13-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-61-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-11-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-9-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-47-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-7-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-6-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-115-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-131-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-129-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-127-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-125-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-123-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-121-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-119-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-117-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-113-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-111-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-109-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-108-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-106-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-104-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-101-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-99-0x0000000005A20000-0x0000000005ABF000-memory.dmp
memory/2476-700-0x0000000005AD0000-0x0000000005AD1000-memory.dmp
memory/2476-701-0x0000000005B60000-0x0000000005B6A000-memory.dmp
memory/2476-702-0x0000000007710000-0x0000000007A64000-memory.dmp
memory/2476-703-0x0000000007B00000-0x0000000007B22000-memory.dmp
memory/2476-704-0x0000000007B40000-0x0000000007B68000-memory.dmp
memory/2476-705-0x0000000005BA0000-0x0000000005BB0000-memory.dmp
memory/2476-706-0x0000000005BA0000-0x0000000005BB0000-memory.dmp
memory/2476-707-0x0000000005BA0000-0x0000000005BB0000-memory.dmp
memory/2476-708-0x0000000008190000-0x00000000081BA000-memory.dmp
memory/2476-841-0x00000000081C0000-0x00000000081C1000-memory.dmp