Analysis
- max time kernel
299s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 04:04
General
- Target Dekont ekte.exe
- Size 1.3MB
- Sample261023-em2yaawvbw
- SHA256 bcb777c4d880fc92a2e95eb04838dcc8de30ab31c9f7e448225a5a84d0535aee
Malware Config
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dekont ekte.exe"C:\Users\Admin\AppData\Local\Temp\Dekont ekte.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5000-845-0x0000000000A60000-0x0000000000AA6000-memory.dmp
memory/5000-847-0x0000000001060000-0x00000000013D4000-memory.dmp
memory/5000-848-0x0000000000A60000-0x0000000000AA6000-memory.dmp
memory/5000-849-0x0000000000A60000-0x0000000000AA6000-memory.dmp
memory/5868-0-0x0000000074B22000-0x0000000074B23000-memory.dmp
memory/5868-1-0x00000000009B0000-0x0000000000AFE000-memory.dmp
memory/5868-2-0x0000000005B40000-0x00000000060FA000-memory.dmp
memory/5868-3-0x00000000054C0000-0x0000000005552000-memory.dmp
memory/5868-4-0x0000000005620000-0x00000000056BC000-memory.dmp
memory/5868-5-0x00000000054B0000-0x00000000054BA000-memory.dmp
memory/5868-6-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5868-7-0x00000000056C0000-0x0000000005734000-memory.dmp
memory/5868-103-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-113-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-131-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-129-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-127-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-125-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-123-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-11-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-121-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-119-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-117-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-115-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-111-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-109-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-107-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-105-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-101-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-99-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-97-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-95-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-94-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-91-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-89-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-87-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-83-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-81-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-79-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-77-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-75-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-74-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-72-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-69-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-67-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-63-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-61-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-59-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-57-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-55-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-53-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-51-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-49-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-47-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-45-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-41-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-39-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-38-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-35-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-31-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-29-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-27-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-24-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-17-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-21-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-20-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-15-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-14-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-13-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-9-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-8-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-85-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-65-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-43-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-33-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-25-0x00000000056C0000-0x000000000574F000-memory.dmp
memory/5868-702-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5868-703-0x0000000007CB0000-0x000000000800B000-memory.dmp
memory/5868-704-0x0000000006B00000-0x0000000006B22000-memory.dmp
memory/5868-705-0x0000000005B10000-0x0000000005B38000-memory.dmp
memory/5868-706-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5868-707-0x0000000074B22000-0x0000000074B23000-memory.dmp
memory/5868-708-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5868-709-0x0000000008010000-0x000000000803A000-memory.dmp
memory/5868-842-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5868-843-0x0000000074B10000-0x00000000752CC000-memory.dmp
memory/5868-846-0x0000000074B10000-0x00000000752CC000-memory.dmp