Loading ...

Play interactive tourEdit tour

Analysis Report Halkbank_Ekstre_20210113_162325_384771.exe

Overview

General Information

Sample Name:Halkbank_Ekstre_20210113_162325_384771.exe
Analysis ID:339368
MD5:8bdf3d3cb7c7680df5b8d6385dc5db82
SHA1:442eaa27d23dc72fd96c9d2d984068669afbeb5d
SHA256:a3c564db9537f84073828e42af85c0558e763cb211e80bd4653e429ecb62ce8b
Tags:AgentTeslaexegeoHalkbankTUR

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
.NET source code contains very large array initializations
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "VVkDExoCFG4o1k", "URL: ": "http://2cRhONggGD4U87PUSY.com", "To: ": "muhasebe@ceotech.com.tr", "ByHost: ": "mail.ceotech.com.tr:587", "Password: ": "JRuuV68u86gFWkr", "From: ": "muhasebe@ceotech.com.tr"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000001.00000002.625929224.0000000003020000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000001.00000002.628470056.0000000004091000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000002.253943134.0000000000F70000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 5 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                    0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 2 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Antivirus / Scanner detection for submitted sampleShow sources
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeAvira: detected
                      Found malware configurationShow sources
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe.6128.1.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "VVkDExoCFG4o1k", "URL: ": "http://2cRhONggGD4U87PUSY.com", "To: ": "muhasebe@ceotech.com.tr", "ByHost: ": "mail.ceotech.com.tr:587", "Password: ": "JRuuV68u86gFWkr", "From: ": "muhasebe@ceotech.com.tr"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeVirustotal: Detection: 36%Perma Link
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeReversingLabs: Detection: 45%
                      Machine Learning detection for sampleShow sources
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeJoe Sandbox ML: detected
                      Source: 0.0.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpackAvira: Label: TR/ATRAPS.Gen
                      Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpackAvira: Label: TR/Spy.Gen8
                      Source: 1.0.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpackAvira: Label: TR/ATRAPS.Gen
                      Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpackAvira: Label: TR/ATRAPS.Gen
                      Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.1.unpackAvira: Label: TR/ATRAPS.Gen
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: wntdll.pdbUGP source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.249231876.000000001AA10000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.249231876.000000001AA10000.00000004.00000001.sdmp
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00404A29 FindFirstFileExW,1_2_00404A29

                      Networking:

                      barindex
                      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
                      Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49711 -> 109.232.220.251:587
                      Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49712 -> 109.232.220.251:587
                      C2 URLs / IPs found in malware configurationShow sources
                      Source: Malware configuration extractorURLs: http://2cRhONggGD4U87PUSY.com
                      Source: global trafficTCP traffic: 192.168.2.7:49711 -> 109.232.220.251:587
                      Source: Joe Sandbox ViewASN Name: AEROTEK-ASTR AEROTEK-ASTR
                      Source: global trafficTCP traffic: 192.168.2.7:49711 -> 109.232.220.251:587
                      Source: unknownDNS traffic detected: queries for: mail.ceotech.com.tr
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://2cRhONggGD4U87PUSY.com
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://2cRhONggGD4U87PUSY.comt
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://FStglU.com
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628097347.00000000033E1000.00000004.00000001.sdmpString found in binary or memory: http://ceotech.com.tr
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628097347.00000000033E1000.00000004.00000001.sdmpString found in binary or memory: http://mail.ceotech.com.tr
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, u003cPrivateImplementationDetailsu003eu007b3752B29Bu002dA071u002d43B4u002dA1DDu002dB2F2C00BE4FEu007d/u0037AC9F4C1u002d786Cu002d4F17u002d9724u002dE34B08F37C3F.csLarge array initialization: .cctor: array initializer size 11938
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED60C00_2_00ED60C0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED683C0_2_00ED683C
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED04320_2_00ED0432
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED55E00_2_00ED55E0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED51BC0_2_00ED51BC
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED79910_2_00ED7991
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ECA9510_2_00ECA951
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ECD9290_2_00ECD929
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED5B500_2_00ED5B50
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0040A2A51_2_0040A2A5
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED60C01_2_00ED60C0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED683C1_2_00ED683C
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED04321_2_00ED0432
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED55E01_2_00ED55E0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED51BC1_2_00ED51BC
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED79911_2_00ED7991
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ECA9511_2_00ECA951
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ECD9291_2_00ECD929
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED5B501_2_00ED5B50
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_010060C81_2_010060C8
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01002A081_2_01002A08
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01004A501_2_01004A50
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0100AAA01_2_0100AAA0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_010054281_2_01005428
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01007F581_2_01007F58
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0100C0501_2_0100C050
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0100E6981_2_0100E698
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01012D501_2_01012D50
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0101F4E81_2_0101F4E8
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01011FE21_2_01011FE2
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_010126181_2_01012618
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01019DB81_2_01019DB8
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0101F4891_2_0101F489
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01019AC31_2_01019AC3
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012E99E01_2_012E99E0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012E60681_2_012E6068
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012EE3181_2_012EE318
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012EBA381_2_012EBA38
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012E5E481_2_012E5E48
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012E71901_2_012E7190
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012ED8171_2_012ED817
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: String function: 00EC715C appears 370 times
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: String function: 00EC9160 appears 64 times
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: String function: 00EC7021 appears 40 times
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: String function: 00EC6F06 appears 36 times
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: String function: 00EC6EF1 appears 84 times
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: String function: 00ECBFC3 appears 38 times
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.252138972.000000001ACBF000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeBinary or memory string: OriginalFilename vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameDcEdwonAXzKWxMNmQOCUH.exe4 vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.623266381.0000000000E70000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.623515086.0000000000FF8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625030855.00000000012F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/1@2/1
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00401489 GetModuleHandleW,GetModuleHandleW,FindResourceW,GetModuleHandleW,LoadResource,LockResource,GetModuleHandleW,SizeofResource,FreeResource,ExitProcess,1_2_00401489
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile created: C:\Users\user\AppData\Roaming\bdbdmgwj.xzvJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: Kernel32.dll0_2_00EC1040
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: User32.dll0_2_00EC1040
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: User32.dll0_2_00EC1040
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: IEUCIZEO0_2_00EC1040
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: Kernel32.dll1_2_00EC1040
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: User32.dll1_2_00EC1040
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: User32.dll1_2_00EC1040
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: IEUCIZEO1_2_00EC1040
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeVirustotal: Detection: 36%
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeReversingLabs: Detection: 45%
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile read: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'
                      Source: unknownProcess created: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess created: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe' Jump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: wntdll.pdbUGP source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.249231876.000000001AA10000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.249231876.000000001AA10000.00000004.00000001.sdmp
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED1B13 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,0_2_00ED1B13
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00EC91A5 push ecx; ret 0_2_00EC91B8
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00401F16 push ecx; ret 1_2_00401F29
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00EC91A5 push ecx; ret 1_2_00EC91B8
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01017A37 push edi; retn 0000h1_2_01017A39
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012ED5B0 push es; ret 1_2_012ED5C0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion:

                      barindex
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWindow / User API: threadDelayed 9003Jump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWindow / User API: threadDelayed 846Jump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe TID: 2724Thread sleep time: -19369081277395017s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe TID: 2188Thread sleep count: 9003 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe TID: 2188Thread sleep count: 846 > 30Jump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00404A29 FindFirstFileExW,1_2_00404A29
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000003.477281323.0000000006618000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012EE0CF LdrInitializeThunk,1_2_012EE0CF
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00EC8A1C _memset,IsDebuggerPresent,0_2_00EC8A1C
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED1B13 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,0_2_00ED1B13
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED1B13 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,0_2_00ED1B13
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00EC6A00 mov eax, dword ptr fs:[00000030h]0_2_00EC6A00
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00CFF40D mov eax, dword ptr fs:[00000030h]0_2_00CFF40D
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00CFE9B6 mov eax, dword ptr fs:[00000030h]0_2_00CFE9B6
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00CFF2C5 mov eax, dword ptr fs:[00000030h]0_2_00CFF2C5
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00CFF262 mov eax, dword ptr fs:[00000030h]0_2_00CFF262
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00CFF225 mov eax, dword ptr fs:[00000030h]0_2_00CFF225
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_004035F1 mov eax, dword ptr fs:[00000030h]1_2_004035F1
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00EC6A00 mov eax, dword ptr fs:[00000030h]1_2_00EC6A00
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00EC6B80 GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapAlloc,0_2_00EC6B80
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ECC0A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00ECC0A3
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ECC080 SetUnhandledExceptionFilter,0_2_00ECC080
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00401E1D SetUnhandledExceptionFilter,1_2_00401E1D
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_0040446F
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00401C88 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00401C88
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00401F30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00401F30
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ECC0A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00ECC0A3
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ECC080 SetUnhandledExceptionFilter,1_2_00ECC080
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeMemory allocated: page read and write | page guardJump to behavior

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Maps a DLL or memory area into another processShow sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeSection loaded: unknown target: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe protection: execute and read and writeJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess created: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe' Jump to behavior
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625144838.0000000001860000.00000002.00000001.sdmpBinary or memory string: uProgram Manager
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625144838.0000000001860000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625144838.0000000001860000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625144838.0000000001860000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ECD7B7 cpuid 0_2_00ECD7B7
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ECFC48 GetSystemTimeAsFileTime,GetCurrentThreadId,GetTickCount64,QueryPerformanceCounter,0_2_00ECFC48
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.625929224.0000000003020000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.628470056.0000000004091000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.253943134.0000000000F70000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.624730399.0000000001209000.00000004.00000020.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128, type: MEMORY
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                      Tries to harvest and steal browser information (history, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                      Tries to harvest and steal ftp login credentialsShow sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\Jump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
                      Tries to steal Mail credentials (via file access)Show sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                      Source: Yara matchFile source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128, type: MEMORY

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.625929224.0000000003020000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.628470056.0000000004091000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.253943134.0000000000F70000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.624730399.0000000001209000.00000004.00000020.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128, type: MEMORY
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.raw.unpack, type: UNPACKEDPE

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Path InterceptionProcess Injection112Disable or Modify Tools1OS Credential Dumping2System Time Discovery1Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsNative API1Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDeobfuscate/Decode Files or Information11Credentials in Registry1File and Directory Discovery1Remote Desktop ProtocolData from Local System2Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsCommand and Scripting Interpreter2Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information2Security Account ManagerSystem Information Discovery125SMB/Windows Admin SharesEmail Collection1Automated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Software Packing1NTDSSecurity Software Discovery141Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol111SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptMasquerading1LSA SecretsVirtualization/Sandbox Evasion13SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonVirtualization/Sandbox Evasion13Cached Domain CredentialsProcess Discovery2VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsProcess Injection112DCSyncApplication Window Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemRemote System Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 signatures2 2