Analysis
-
max time kernel
127s -
max time network
138s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 08:04
Static task
static1
Behavioral task
behavioral1
Sample
Halkbank_Ekstre_20210118_162356_389771.exe
Resource
win7v20201028
General
-
Target
Halkbank_Ekstre_20210118_162356_389771.exe
-
Size
1003KB
-
MD5
84217fc5c07aabf3321ed2c0feed1cba
-
SHA1
4ba652be61d9185a8ae35f12a951d315f2c5dec5
-
SHA256
cdcc8531c42e3ede33c0ecbcb82f7a6e5445e959eee3796475258df830a18813
-
SHA512
923d5fb3e3879837e338d0437a8751074a8114f8e6d7f8c0e4c960109b00bafe9d92be41db9ed46f20249cf6b5d4f90f5b8ed173f7d0a6b1df16c046e7f50f13
Malware Config
Extracted
asyncrat
0.5.7B
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1604
91.193.75.189:6606
91.193.75.189:7707
91.193.75.189:8808
91.193.75.189:1604
AsyncMutex_6SI8OkPnk
-
aes_key
mfafeIQA2jA2dXxxjBmJHl3XAeFPQwQb
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
127.0.0.1,91.193.75.189
-
hwid
10
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6606,7707,8808,1604
-
version
0.5.7B
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1520-10-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/1520-11-0x000000000040D0AE-mapping.dmp asyncrat behavioral1/memory/1520-13-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Halkbank_Ekstre_20210118_162356_389771.exedescription pid process target process PID 1740 set thread context of 1520 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Halkbank_Ekstre_20210118_162356_389771.exepid process 1740 Halkbank_Ekstre_20210118_162356_389771.exe 1740 Halkbank_Ekstre_20210118_162356_389771.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Halkbank_Ekstre_20210118_162356_389771.exedescription pid process Token: SeDebugPrivilege 1740 Halkbank_Ekstre_20210118_162356_389771.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Halkbank_Ekstre_20210118_162356_389771.exedescription pid process target process PID 1740 wrote to memory of 1504 1740 Halkbank_Ekstre_20210118_162356_389771.exe schtasks.exe PID 1740 wrote to memory of 1504 1740 Halkbank_Ekstre_20210118_162356_389771.exe schtasks.exe PID 1740 wrote to memory of 1504 1740 Halkbank_Ekstre_20210118_162356_389771.exe schtasks.exe PID 1740 wrote to memory of 1504 1740 Halkbank_Ekstre_20210118_162356_389771.exe schtasks.exe PID 1740 wrote to memory of 924 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 1740 wrote to memory of 924 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 1740 wrote to memory of 924 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 1740 wrote to memory of 924 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 1740 wrote to memory of 1520 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 1740 wrote to memory of 1520 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 1740 wrote to memory of 1520 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 1740 wrote to memory of 1520 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 1740 wrote to memory of 1520 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 1740 wrote to memory of 1520 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 1740 wrote to memory of 1520 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 1740 wrote to memory of 1520 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 1740 wrote to memory of 1520 1740 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210118_162356_389771.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210118_162356_389771.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JsghWrfn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp71D6.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210118_162356_389771.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210118_162356_389771.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210118_162356_389771.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210118_162356_389771.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp71D6.tmpMD5
a52ddbf195b50c4b79d5a2c80f2a9412
SHA1229e9b8a3c29899f8d9dd5d834df3b447e3268d8
SHA25684e6c3fc9b3edd2516c3aa21df2f259175b601e8c3dfddcd48c3d4cb57af948d
SHA5122b5f3c7b69b864453d01281fec64c1a73c8bc31029bf3c4771498e73e15ade495caa83cfc960a96b5446ec007ddb055feda955c1052e24d58fbe4b09cac29d6f
-
memory/1504-8-0x0000000000000000-mapping.dmp
-
memory/1520-12-0x00000000741A0000-0x000000007488E000-memory.dmpFilesize
6.9MB
-
memory/1520-10-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1520-11-0x000000000040D0AE-mapping.dmp
-
memory/1520-13-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1520-15-0x00000000766F1000-0x00000000766F3000-memory.dmpFilesize
8KB
-
memory/1520-16-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/1740-6-0x0000000000480000-0x0000000000493000-memory.dmpFilesize
76KB
-
memory/1740-7-0x0000000005230000-0x00000000052BB000-memory.dmpFilesize
556KB
-
memory/1740-5-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/1740-3-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/1740-2-0x00000000741A0000-0x000000007488E000-memory.dmpFilesize
6.9MB