IOC Report
Halkbank_Ekstre_20230426_075819_154055.exe

loading gif

Files

File Path
Type
Category
Malicious
Halkbank_Ekstre_20230426_075819_154055.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Halkbank_Ekstre_20230426_075819_154055.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe
"C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe"
 malicious
C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe
"C:\Users\user\Desktop\Halkbank_Ekstre_20230426_075819_154055.exe"
 malicious

URLs

Name
IP
Malicious
http://checkip.dyndns.org/
132.226.247.73
http://tempuri.org/DataSeta.xsd)Microsoft
unknown
http://checkip.dyndns.org/q
unknown
https://scratchdreams.tk
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/191.96.150.225
172.67.177.134
https://scratchdreams.tk/_send_.php?TS
104.21.27.85
http://checkip.dyndns.org
unknown
http://checkip.dyndns.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://scratchdreams.tk
unknown
https://reallyfreegeoip.org/xml/191.96.150.225$
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 4 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
checkip.dyndns.org
unknown
 malicious
reallyfreegeoip.org
172.67.177.134
scratchdreams.tk
104.21.27.85
checkip.dyndns.com
132.226.247.73

IPs

IP
Domain
Country
Malicious
172.67.177.134
reallyfreegeoip.org
United States
104.21.27.85
scratchdreams.tk
United States
132.226.247.73
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Halkbank_Ekstre_20230426_075819_154055_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2813000
trusted library allocation
page read and write
 malicious
394E000
trusted library allocation
page read and write
 malicious
29A1000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
6C00000
trusted library section
page read and write
 malicious
2771000
trusted library allocation
page read and write
 malicious
770000
heap
page read and write
4E55000
trusted library allocation
page read and write
2B4B000
trusted library allocation
page read and write
6ACF000
stack
page read and write
AF7000
stack
page read and write
2C10000
trusted library allocation
page read and write
F63000
trusted library allocation
page execute and read and write
3863000
trusted library allocation
page read and write
509D000
stack
page read and write
39A1000
trusted library allocation
page read and write
2490000
trusted library allocation
page read and write
2560000
trusted library allocation
page read and write
8A2000
heap
page read and write
299E000
stack
page read and write
536E000
stack
page read and write
3A2D000
trusted library allocation
page read and write
A97000
heap
page read and write
4BB0000
trusted library allocation
page read and write
601E000
stack
page read and write
5040000
trusted library allocation
page read and write
A60000
heap
page read and write
4E20000
trusted library allocation
page read and write
66A000
stack
page read and write
7C5000
heap
page read and write
2BF2000
trusted library allocation
page read and write
4E3E000
trusted library allocation
page read and write
643E000
stack
page read and write
4E41000
trusted library allocation
page read and write
9D8F000
stack
page read and write
767000
stack
page read and write
7E0000
heap
page read and write
C58000
heap
page read and write
62AD000
stack
page read and write
2A62000
trusted library allocation
page read and write
F8A000
trusted library allocation
page execute and read and write
CEF000
stack
page read and write
4BD6000
trusted library allocation
page read and write
6890000
heap
page read and write
2AE4000
trusted library allocation
page read and write
790000
trusted library allocation
page read and write
2AD8000
trusted library allocation
page read and write
4E3A000
trusted library allocation
page read and write
D1A000
heap
page read and write
800000
heap
page read and write
2C44000
trusted library allocation
page read and write
2B4E000
trusted library allocation
page read and write
7D0000
heap
page read and write
552E000
stack
page read and write
D40000
heap
page read and write
689E000
heap
page read and write
6E40000
trusted library allocation
page read and write
2B87000
trusted library allocation
page read and write
2700000
trusted library allocation
page execute and read and write
9B8E000
stack
page read and write
F82000
trusted library allocation
page read and write
39C9000
trusted library allocation
page read and write
AC0000
trusted library allocation
page read and write
4C50000
trusted library allocation
page read and write
65FF000
stack
page read and write
1010000
trusted library allocation
page read and write
4C60000
trusted library allocation
page execute and read and write
2C3E000
trusted library allocation
page read and write
998E000
stack
page read and write
3A3B000
trusted library allocation
page read and write
79B000
trusted library allocation
page read and write
C40000
trusted library allocation
page read and write
69CE000
stack
page read and write
BEF000
stack
page read and write
809000
heap
page read and write
2C0B000
trusted library allocation
page read and write
24AB000
trusted library allocation
page execute and read and write
99CE000
stack
page read and write
780000
trusted library allocation
page read and write
6E8E000
stack
page read and write
5170000
heap
page read and write
4D20000
heap
page read and write
4CF0000
heap
page read and write
2A65000
trusted library allocation
page read and write
2B06000
trusted library allocation
page read and write
4E26000
trusted library allocation
page read and write
8A6000
heap
page read and write
4F73000
heap
page read and write
24C0000
trusted library allocation
page read and write
6620000
trusted library allocation
page execute and read and write
6D40000
trusted library allocation
page execute and read and write
2A7D000
trusted library allocation
page read and write
F80000
trusted library allocation
page read and write
26E8000
trusted library allocation
page read and write
37C7000
trusted library allocation
page read and write
4E46000
trusted library allocation
page read and write
2550000
trusted library allocation
page execute and read and write
AE0000
heap
page read and write
2496000
trusted library allocation
page execute and read and write
C79000
heap
page read and write
E50000
heap
page read and write
F60000
trusted library allocation
page read and write
61C3000
heap
page read and write
7B0000
trusted library allocation
page execute and read and write
61B5000
heap
page read and write
4D00000
heap
page read and write
4E70000
heap
page read and write
2C4A000
trusted library allocation
page read and write
254C000
stack
page read and write
249A000
trusted library allocation
page execute and read and write
6600000
trusted library allocation
page read and write
AC3000
trusted library allocation
page execute and read and write
A4E000
stack
page read and write
2740000
trusted library allocation
page read and write
280A000
trusted library allocation
page read and write
24A0000
trusted library allocation
page read and write
6AE0000
heap
page read and write
DF0000
heap
page read and write
546E000
stack
page read and write
633E000
stack
page read and write
2ADC000
trusted library allocation
page read and write
4F50000
heap
page execute and read and write
7B0000
heap
page read and write
4BCE000
trusted library allocation
page read and write
7A0000
trusted library allocation
page execute and read and write
4E52000
trusted library allocation
page read and write
605E000
stack
page read and write
78C000
trusted library allocation
page read and write
515E000
stack
page read and write
24A2000
trusted library allocation
page read and write
AD3000
trusted library allocation
page read and write
2B21000
trusted library allocation
page read and write
70A000
stack
page read and write
7B5000
heap
page read and write
834000
heap
page read and write
647E000
stack
page read and write
4C00000
trusted library allocation
page read and write
668E000
trusted library allocation
page read and write
2BF8000
trusted library allocation
page read and write
6B20000
heap
page read and write
AB0000
trusted library allocation
page read and write
26DE000
stack
page read and write
6EB2000
trusted library allocation
page read and write
2745000
trusted library allocation
page read and write
3815000
trusted library allocation
page read and write
26E0000
trusted library allocation
page read and write
2AF0000
trusted library allocation
page read and write
3A08000
trusted library allocation
page read and write
1020000
trusted library allocation
page read and write
4BBB000
trusted library allocation
page read and write
F9B000
trusted library allocation
page execute and read and write
F64000
trusted library allocation
page read and write
80E000
heap
page read and write
A90000
heap
page read and write
5190000
heap
page read and write
6BF0000
trusted library allocation
page execute and read and write
2890000
heap
page read and write
F6D000
trusted library allocation
page execute and read and write
6E30000
trusted library allocation
page read and write
5160000
heap
page read and write
A0E000
stack
page read and write
2580000
trusted library allocation
page read and write
4F40000
trusted library allocation
page execute and read and write
4F70000
heap
page read and write
6AD0000
trusted library section
page read and write
F70000
trusted library allocation
page read and write
5120000
heap
page execute and read and write
2AE0000
trusted library allocation
page read and write
50DE000
stack
page read and write
4CE0000
trusted library section
page readonly
FFE000
stack
page read and write
6C10000
trusted library allocation
page read and write
394000
unkown
page readonly
400000
remote allocation
page execute and read and write
1024000
trusted library allocation
page read and write
2590000
heap
page read and write
F97000
trusted library allocation
page execute and read and write
7C0000
heap
page read and write
6630000
trusted library allocation
page execute and read and write
64BF000
stack
page read and write
1030000
heap
page read and write
2750000
trusted library allocation
page read and write
486B000
stack
page read and write
8387000
trusted library allocation
page read and write
840000
heap
page read and write
4C70000
trusted library allocation
page read and write
4CDB000
stack
page read and write
7300000
trusted library section
page read and write
2C38000
trusted library allocation
page read and write
9C8F000
stack
page read and write
2B89000
trusted library allocation
page read and write
5DDF000
stack
page read and write
C10000
heap
page read and write
843000
heap
page read and write
2B5D000
trusted library allocation
page read and write
7F0000
heap
page read and write
2C02000
trusted library allocation
page read and write
C50000
heap
page read and write
4E2E000
trusted library allocation
page read and write
302000
unkown
page readonly
AC4000
trusted library allocation
page read and write
2AEC000
trusted library allocation
page read and write
3779000
trusted library allocation
page read and write
2760000
heap
page execute and read and write
2A93000
trusted library allocation
page read and write
F92000
trusted library allocation
page read and write
4BDD000
trusted library allocation
page read and write
2492000
trusted library allocation
page read and write
5050000
heap
page read and write
2AF4000
trusted library allocation
page read and write
4ADE000
stack
page read and write
6160000
heap
page read and write
2A9C000
trusted library allocation
page read and write
ADD000
trusted library allocation
page execute and read and write
5030000
trusted library allocation
page read and write
ACD000
trusted library allocation
page execute and read and write
3A23000
trusted library allocation
page read and write
5BDF000
stack
page read and write
3A39000
trusted library allocation
page read and write
2570000
trusted library allocation
page read and write
4D10000
heap
page read and write
615E000
stack
page read and write
4D23000
heap
page read and write
5EDE000
stack
page read and write
250E000
stack
page read and write
4E2B000
trusted library allocation
page read and write
F7D000
trusted library allocation
page execute and read and write
2C14000
trusted library allocation
page read and write
2B2F000
trusted library allocation
page read and write
2C7B000
trusted library allocation
page read and write
511E000
stack
page read and write
88B000
heap
page read and write
4BB4000
trusted library allocation
page read and write
3771000
trusted library allocation
page read and write
62EE000
stack
page read and write
2B6B000
trusted library allocation
page read and write
5F1E000
stack
page read and write
2AE8000
trusted library allocation
page read and write
4E4D000
trusted library allocation
page read and write
2BED000
trusted library allocation
page read and write
789000
trusted library allocation
page read and write
2880000
heap
page execute and read and write
269F000
stack
page read and write
6680000
trusted library allocation
page read and write
2AA4000
trusted library allocation
page read and write
64FE000
stack
page read and write
2AF8000
trusted library allocation
page read and write
D70000
trusted library allocation
page read and write
2A91000
trusted library allocation
page read and write
F95000
trusted library allocation
page execute and read and write
24A7000
trusted library allocation
page execute and read and write
4E60000
trusted library allocation
page read and write
860E000
stack
page read and write
2AA8000
trusted library allocation
page read and write
787000
trusted library allocation
page read and write
4C52000
trusted library allocation
page read and write
54EE000
stack
page read and write
D60000
trusted library allocation
page read and write
1000000
trusted library allocation
page execute and read and write
49DE000
stack
page read and write
5055000
heap
page read and write
4BD1000
trusted library allocation
page read and write
6BE0000
trusted library allocation
page read and write
D50000
trusted library allocation
page read and write
2AA0000
trusted library allocation
page read and write
F86000
trusted library allocation
page execute and read and write
300000
unkown
page readonly
616D000
heap
page read and write
E10000
trusted library allocation
page execute and read and write
8C0000
heap
page read and write
4C40000
heap
page read and write
AD0000
trusted library allocation
page read and write
D6B000
trusted library allocation
page read and write
C87000
heap
page read and write
827000
heap
page read and write
There are 265 hidden memdumps, click here to show them.