d25f524faf11aee50288503f06409544fe07433df48455e89b2376de13255ff5 | Triage

Analysis

max time kernel
136s
max time network
93s
platform
windows10_x64
resource
win10v200430
submitted
10-07-2020 12:22

Sharing

Report Analysis Logs

General

Target

T. HALK BANKASI A.S.exe
Size

489KB
MD5

be55dd6e2a8fb0d8e12fa824aa57d8c2
SHA1

cbab35a49fa6c4597ccbcf8ff19b3a880457ff8d
SHA256

d25f524faf11aee50288503f06409544fe07433df48455e89b2376de13255ff5
SHA512

75f8f91a5abe004aff29a15d21616580c61aac677a04cfee9893a9475242f33d25212bc432c53d5f4b4c38a85366fbe3493b897cee0824b4867111cf9f0d7930

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2436	3944	WerFault.exe	65

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3944	T. HALK BANKASI A.S.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe
2436	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3944	T. HALK BANKASI A.S.exe
Token: SeRestorePrivilege	2436	WerFault.exe
Token: SeBackupPrivilege	2436	WerFault.exe
Token: SeDebugPrivilege	2436	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\T. HALK BANKASI A.S.exe
"C:\Users\Admin\AppData\Local\Temp\T. HALK BANKASI A.S.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 1276
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2436-0-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/2436-1-0x00000000055A0000-0x00000000055A1000-memory.dmp

Filesize
4KB

Download