IOC Report
E-DEKONT.exe

loading gif

Files

File Path
Type
Category
Malicious
E-DEKONT.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\nsc1ED3.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Ydervgg\Superassume\dodecaheddra\Internalisere\Brnesangen.End
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Ydervgg\Superassume\dodecaheddra\Sldede\memstat.c
C source, ASCII text
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Ydervgg\Superassume\dodecaheddra\Sldede\selection-end-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Ydervgg\Superassume\dodecaheddra\logicalization\libxml2-2.0.typelib
HTML document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Ydervgg\Superassume\dodecaheddra\logicalization\sgelngdernes.Dep74
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\E-DEKONT.exe
C:\Users\user\Desktop\E-DEKONT.exe
 malicious

URLs

Name
IP
Malicious
http://nsis.sf.net/NSIS_ErrorError
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fivefoldness\Endosseringerne\Fouragen
Arigue
HKEY_CURRENT_USER\Software\Fruticeta\Lavandin\Kingliest\Ernringsenhed
Legating

Memdumps

Base Address
Regiontype
Protect
Malicious
2980000
direct allocation
page execute and read and write
 malicious
1F53A60E000
trusted library allocation
page read and write
476000
unkown
page readonly
40A000
unkown
page write copy
D05F5FE000
stack
page read and write
1F53A390000
trusted library allocation
page read and write
1F535E70000
trusted library section
page readonly
40A000
unkown
page read and write
D05F7FB000
stack
page read and write
1F53A6C0000
remote allocation
page read and write
730000
heap
page read and write
1F534C72000
heap
page read and write
1F53A240000
trusted library allocation
page read and write
1F53A608000
trusted library allocation
page read and write
1F535C70000
trusted library allocation
page read and write
D05F2F7000
stack
page read and write
1F53A4F7000
heap
page read and write
1F534D02000
heap
page read and write
1F535602000
heap
page read and write
D05F3FC000
stack
page read and write
277F000
stack
page read and write
1F53A680000
trusted library allocation
page read and write
401000
unkown
page execute read
1F53A3D0000
trusted library allocation
page read and write
1F534BC0000
heap
page read and write
D05F9FF000
stack
page read and write
45C000
unkown
page read and write
431000
unkown
page read and write
1F53A4FB000
heap
page read and write
1F53A4DB000
heap
page read and write
22E0000
trusted library allocation
page read and write
22F0000
heap
page read and write
22DF000
stack
page read and write
1F53A45D000
heap
page read and write
D05F8FE000
stack
page read and write
30000
heap
page read and write
D05F87F000
stack
page read and write
1F534BF0000
trusted library allocation
page read and write
1F53A360000
trusted library allocation
page read and write
1F535E90000
trusted library section
page readonly
1F534D13000
heap
page read and write
1F534C58000
heap
page read and write
1F53A440000
heap
page read and write
1F534CFE000
heap
page read and write
1F534C13000
heap
page read and write
1F535718000
heap
page read and write
10001000
unkown
page execute read
2850000
trusted library allocation
page read and write
400000
unkown
page readonly
1F53A4F1000
heap
page read and write
1F53A4F9000
heap
page read and write
1F534B50000
heap
page read and write
42F000
unkown
page read and write
1F535615000
heap
page read and write
1F535700000
heap
page read and write
1F53A41F000
heap
page read and write
1F53A44D000
heap
page read and write
437000
unkown
page read and write
1F53A627000
trusted library allocation
page read and write
D05FA7F000
stack
page read and write
408000
unkown
page readonly
D05F4FA000
stack
page read and write
1F535E80000
trusted library section
page readonly
1F53A250000
trusted library allocation
page read and write
D05FCFE000
stack
page read and write
1F53A690000
trusted library allocation
page read and write
1F53A3A0000
trusted library allocation
page read and write
1F53A464000
heap
page read and write
1F53A6C0000
remote allocation
page read and write
1F53A390000
trusted library allocation
page read and write
1F534C41000
heap
page read and write
10003000
unkown
page readonly
97000
stack
page read and write
43C000
unkown
page read and write
2130000
heap
page read and write
1F535E60000
trusted library section
page readonly
401000
unkown
page execute read
769000
heap
page read and write
400000
unkown
page readonly
10000000
unkown
page readonly
1F534CA1000
heap
page read and write
408000
unkown
page readonly
560000
trusted library allocation
page read and write
2840000
trusted library allocation
page read and write
1F534C8F000
heap
page read and write
10005000
unkown
page readonly
267E000
stack
page read and write
1F53A621000
trusted library allocation
page read and write
2134000
heap
page read and write
1F53A4A9000
heap
page read and write
21D0000
heap
page read and write
1F534B60000
heap
page read and write