Analysis
- max time kernel
299s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 09:06
General
- Target Dekont.exe
- Size 1.2MB
- Sample261020-k2thcaxycy
- SHA256 38aa284ea16dbbd2189ec674eddea0ecb7210b6ffb0ec3b8979a64ebd3714821
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dekont.exe"C:\Users\Admin\AppData\Local\Temp\Dekont.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2916-845-0x0000000001630000-0x0000000001676000-memory.dmp
memory/2916-847-0x0000000001BA0000-0x0000000001F14000-memory.dmp
memory/2916-848-0x0000000001630000-0x0000000001676000-memory.dmp
memory/2916-849-0x0000000001630000-0x0000000001676000-memory.dmp
memory/6076-0-0x0000000074A72000-0x0000000074A73000-memory.dmp
memory/6076-1-0x0000000000790000-0x00000000008D2000-memory.dmp
memory/6076-2-0x0000000005820000-0x0000000005DDA000-memory.dmp
memory/6076-3-0x0000000005300000-0x0000000005392000-memory.dmp
memory/6076-4-0x00000000053A0000-0x000000000543C000-memory.dmp
memory/6076-5-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/6076-6-0x0000000005440000-0x00000000054B4000-memory.dmp
memory/6076-138-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-136-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-135-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-129-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-132-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-131-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-123-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-120-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-118-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-114-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-112-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-107-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-103-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-90-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-88-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-127-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-105-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-100-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-92-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-84-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-52-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-86-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-82-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-80-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-78-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-76-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-74-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-72-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-70-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-66-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-65-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-62-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-60-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-59-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-56-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-55-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-50-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-701-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/6076-48-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-46-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-44-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-42-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-40-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-38-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-36-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-34-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-32-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-30-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-28-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-26-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-24-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-22-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-21-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-18-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-16-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-14-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-12-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-11-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-8-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-7-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-124-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-116-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-96-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-95-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-68-0x0000000005440000-0x00000000054DF000-memory.dmp
memory/6076-702-0x0000000005660000-0x000000000566A000-memory.dmp
memory/6076-703-0x00000000079C0000-0x0000000007D1B000-memory.dmp
memory/6076-704-0x0000000007D20000-0x0000000007D42000-memory.dmp
memory/6076-705-0x0000000007D50000-0x0000000007D78000-memory.dmp
memory/6076-706-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/6076-707-0x0000000074A72000-0x0000000074A73000-memory.dmp
memory/6076-708-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/6076-709-0x0000000001020000-0x000000000104A000-memory.dmp
memory/6076-842-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/6076-843-0x0000000074A60000-0x000000007521C000-memory.dmp
memory/6076-846-0x0000000074A60000-0x000000007521C000-memory.dmp