Analysis
- max time kernel
298s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
23/10/2026, 04:04
General
- Target Dekont ekte.exe
- Size 1.3MB
- Sample261023-em2yaawvbw
- SHA256 bcb777c4d880fc92a2e95eb04838dcc8de30ab31c9f7e448225a5a84d0535aee
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dekont ekte.exe"C:\Users\Admin\AppData\Local\Temp\Dekont ekte.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1592-844-0x0000000001260000-0x00000000012A6000-memory.dmp
memory/1592-845-0x0000000001750000-0x0000000001A9A000-memory.dmp
memory/1592-846-0x0000000001260000-0x00000000012A6000-memory.dmp
memory/1592-847-0x0000000001260000-0x00000000012A6000-memory.dmp
memory/4424-0-0x0000000000490000-0x00000000005DE000-memory.dmp
memory/4424-1-0x0000000005570000-0x0000000005B14000-memory.dmp
memory/4424-2-0x0000000004FC0000-0x0000000005052000-memory.dmp
memory/4424-3-0x0000000005100000-0x000000000519C000-memory.dmp
memory/4424-4-0x0000000005250000-0x0000000005260000-memory.dmp
memory/4424-5-0x0000000005070000-0x000000000507A000-memory.dmp
memory/4424-6-0x00000000051A0000-0x0000000005214000-memory.dmp
memory/4424-22-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-28-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-128-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-132-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-130-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-126-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-124-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-123-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-118-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-116-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-114-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-112-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-110-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-108-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-106-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-104-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-102-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-100-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-98-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-96-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-94-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-92-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-90-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-88-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-84-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-83-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-80-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-78-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-76-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-74-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-72-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-120-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-86-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-68-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-66-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-64-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-62-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-60-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-59-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-56-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-54-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-52-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-50-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-46-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-44-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-42-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-40-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-38-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-36-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-34-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-32-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-30-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-26-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-24-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-701-0x0000000005350000-0x0000000005351000-memory.dmp
memory/4424-703-0x0000000007200000-0x0000000007222000-memory.dmp
memory/4424-705-0x0000000005250000-0x0000000005260000-memory.dmp
memory/4424-704-0x0000000007230000-0x0000000007258000-memory.dmp
memory/4424-702-0x0000000006EA0000-0x00000000071F4000-memory.dmp
memory/4424-20-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-19-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-16-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-14-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-12-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-10-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-8-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-70-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-48-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-7-0x00000000051A0000-0x000000000522F000-memory.dmp
memory/4424-706-0x0000000005250000-0x0000000005260000-memory.dmp
memory/4424-707-0x0000000005250000-0x0000000005260000-memory.dmp
memory/4424-708-0x0000000006CD0000-0x0000000006CFA000-memory.dmp
memory/4424-841-0x0000000006D00000-0x0000000006D01000-memory.dmp