Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 08:04
Static task
static1
Behavioral task
behavioral1
Sample
Halkbank_Ekstre_20210118_162356_389771.exe
Resource
win7v20201028
General
-
Target
Halkbank_Ekstre_20210118_162356_389771.exe
-
Size
1003KB
-
MD5
84217fc5c07aabf3321ed2c0feed1cba
-
SHA1
4ba652be61d9185a8ae35f12a951d315f2c5dec5
-
SHA256
cdcc8531c42e3ede33c0ecbcb82f7a6e5445e959eee3796475258df830a18813
-
SHA512
923d5fb3e3879837e338d0437a8751074a8114f8e6d7f8c0e4c960109b00bafe9d92be41db9ed46f20249cf6b5d4f90f5b8ed173f7d0a6b1df16c046e7f50f13
Malware Config
Extracted
asyncrat
0.5.7B
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
127.0.0.1:1604
91.193.75.189:6606
91.193.75.189:7707
91.193.75.189:8808
91.193.75.189:1604
AsyncMutex_6SI8OkPnk
-
aes_key
mfafeIQA2jA2dXxxjBmJHl3XAeFPQwQb
-
anti_detection
false
-
autorun
false
-
bdos
false
-
delay
Default
-
host
127.0.0.1,91.193.75.189
-
hwid
10
- install_file
-
install_folder
%AppData%
-
mutex
AsyncMutex_6SI8OkPnk
-
pastebin_config
null
-
port
6606,7707,8808,1604
-
version
0.5.7B
Signatures
-
Async RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4056-16-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral2/memory/4056-17-0x000000000040D0AE-mapping.dmp asyncrat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Halkbank_Ekstre_20210118_162356_389771.exedescription pid process target process PID 3888 set thread context of 4056 3888 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Halkbank_Ekstre_20210118_162356_389771.exepid process 3888 Halkbank_Ekstre_20210118_162356_389771.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Halkbank_Ekstre_20210118_162356_389771.exedescription pid process Token: SeDebugPrivilege 3888 Halkbank_Ekstre_20210118_162356_389771.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Halkbank_Ekstre_20210118_162356_389771.exedescription pid process target process PID 3888 wrote to memory of 2484 3888 Halkbank_Ekstre_20210118_162356_389771.exe schtasks.exe PID 3888 wrote to memory of 2484 3888 Halkbank_Ekstre_20210118_162356_389771.exe schtasks.exe PID 3888 wrote to memory of 2484 3888 Halkbank_Ekstre_20210118_162356_389771.exe schtasks.exe PID 3888 wrote to memory of 4056 3888 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 3888 wrote to memory of 4056 3888 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 3888 wrote to memory of 4056 3888 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 3888 wrote to memory of 4056 3888 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 3888 wrote to memory of 4056 3888 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 3888 wrote to memory of 4056 3888 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 3888 wrote to memory of 4056 3888 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe PID 3888 wrote to memory of 4056 3888 Halkbank_Ekstre_20210118_162356_389771.exe Halkbank_Ekstre_20210118_162356_389771.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210118_162356_389771.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210118_162356_389771.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JsghWrfn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAA4A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210118_162356_389771.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20210118_162356_389771.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Halkbank_Ekstre_20210118_162356_389771.exe.logMD5
65f1f0c7993639f9f9e1d524224a2c93
SHA15b51a6a56f3041dbc2d3f510252bbe68ffbbc59c
SHA256e582e80a644a998d1b2958bdcb0cd1e899076befa7c5e868d033b3fe75a2ca93
SHA5123e8953968bbc31f3105a0df28b95edfb4cee8af78ec527d47707b82e3d5fc2aa725fca574de3c963da53614e60d282408b21d075eed007be25679e9458bf1c23
-
C:\Users\Admin\AppData\Local\Temp\tmpAA4A.tmpMD5
053e66536e6c95ce23d2cbcfb1da668c
SHA1d6542da30162113614622d0e759150fd14f33ae4
SHA2567e66cc02161c50d966a4debdfb63de2ccd70171303122bdcf05de548dbbb1bcc
SHA512ddeb45ba4cd77fbb70173d11c8600ad265382f15dbf7a01a21d70d09f1693a6219a9af93fd72b1305e9b32ed5981a1e00560969ce8e3e3e3225180967f106ed4
-
memory/2484-14-0x0000000000000000-mapping.dmp
-
memory/3888-7-0x0000000004D90000-0x0000000004D91000-memory.dmpFilesize
4KB
-
memory/3888-13-0x0000000000BF0000-0x0000000000C7B000-memory.dmpFilesize
556KB
-
memory/3888-8-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/3888-9-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB
-
memory/3888-10-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/3888-11-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/3888-12-0x0000000004F40000-0x0000000004F53000-memory.dmpFilesize
76KB
-
memory/3888-2-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/3888-6-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/3888-5-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/3888-3-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/4056-17-0x000000000040D0AE-mapping.dmp
-
memory/4056-16-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4056-19-0x0000000073A20000-0x000000007410E000-memory.dmpFilesize
6.9MB
-
memory/4056-22-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB