c43d47ad1215629d32c33053a321e2ebb0af0c3f013cd7a30abe85ae1cff5bd7

Analysis

max time kernel
150s
max time network
50s
platform
windows7_x64
resource
win7v20210408
submitted
02/06/2021, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HalkbankEkstre02062194872448750221348.exe
Size 165KB
Sample210602-mrt7pffbw6
SHA256 c43d47ad1215629d32c33053a321e2ebb0af0c3f013cd7a30abe85ae1cff5bd7
MD5 9d250c84248cda12d49e48290cacb96a
SHA1 f25ac367b07e0d6758ce158f27d2cd59111caf80
SHA512 2566c45ee4bbb9835b56f77a3b7de36c0bd02c6f013827662c0b3afb83c41702e84d1fc97213a088d2c47ed04c7e7981719adea940f86ce9dad6a75cb3d06e84
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
1956	HalkbankEkstre02062194872448750221348.exe
1956	HalkbankEkstre02062194872448750221348.exe
1576	HalkbankEkstre02062194872448750221348.exe
1576	HalkbankEkstre02062194872448750221348.exe
996	HalkbankEkstre02062194872448750221348.exe
996	HalkbankEkstre02062194872448750221348.exe
1036	HalkbankEkstre02062194872448750221348.exe
1036	HalkbankEkstre02062194872448750221348.exe
1864	HalkbankEkstre02062194872448750221348.exe
1864	HalkbankEkstre02062194872448750221348.exe
1824	HalkbankEkstre02062194872448750221348.exe
1824	HalkbankEkstre02062194872448750221348.exe
932	HalkbankEkstre02062194872448750221348.exe
932	HalkbankEkstre02062194872448750221348.exe
1952	HalkbankEkstre02062194872448750221348.exe
1952	HalkbankEkstre02062194872448750221348.exe
628	HalkbankEkstre02062194872448750221348.exe
628	HalkbankEkstre02062194872448750221348.exe
900	HalkbankEkstre02062194872448750221348.exe
900	HalkbankEkstre02062194872448750221348.exe
944	HalkbankEkstre02062194872448750221348.exe
944	HalkbankEkstre02062194872448750221348.exe
1956	HalkbankEkstre02062194872448750221348.exe
1956	HalkbankEkstre02062194872448750221348.exe
1628	HalkbankEkstre02062194872448750221348.exe
1628	HalkbankEkstre02062194872448750221348.exe
464	HalkbankEkstre02062194872448750221348.exe
464	HalkbankEkstre02062194872448750221348.exe
1660	HalkbankEkstre02062194872448750221348.exe
1660	HalkbankEkstre02062194872448750221348.exe
1060	HalkbankEkstre02062194872448750221348.exe
1060	HalkbankEkstre02062194872448750221348.exe
1548	HalkbankEkstre02062194872448750221348.exe
1548	HalkbankEkstre02062194872448750221348.exe
860	HalkbankEkstre02062194872448750221348.exe
860	HalkbankEkstre02062194872448750221348.exe
1504	HalkbankEkstre02062194872448750221348.exe
1504	HalkbankEkstre02062194872448750221348.exe
1084	HalkbankEkstre02062194872448750221348.exe
1084	HalkbankEkstre02062194872448750221348.exe
1652	HalkbankEkstre02062194872448750221348.exe
1652	HalkbankEkstre02062194872448750221348.exe
1740	HalkbankEkstre02062194872448750221348.exe
1740	HalkbankEkstre02062194872448750221348.exe
1004	HalkbankEkstre02062194872448750221348.exe
1004	HalkbankEkstre02062194872448750221348.exe
1092	HalkbankEkstre02062194872448750221348.exe
1092	HalkbankEkstre02062194872448750221348.exe
1472	HalkbankEkstre02062194872448750221348.exe
1472	HalkbankEkstre02062194872448750221348.exe
1700	HalkbankEkstre02062194872448750221348.exe
1700	HalkbankEkstre02062194872448750221348.exe
556	HalkbankEkstre02062194872448750221348.exe
556	HalkbankEkstre02062194872448750221348.exe
1636	HalkbankEkstre02062194872448750221348.exe
1636	HalkbankEkstre02062194872448750221348.exe
2016	HalkbankEkstre02062194872448750221348.exe
2016	HalkbankEkstre02062194872448750221348.exe
1036	HalkbankEkstre02062194872448750221348.exe
1036	HalkbankEkstre02062194872448750221348.exe
1988	HalkbankEkstre02062194872448750221348.exe
1988	HalkbankEkstre02062194872448750221348.exe
1056	HalkbankEkstre02062194872448750221348.exe
1056	HalkbankEkstre02062194872448750221348.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 53 IoCs

pid	Process
1956	HalkbankEkstre02062194872448750221348.exe
1576	HalkbankEkstre02062194872448750221348.exe
996	HalkbankEkstre02062194872448750221348.exe
1036	HalkbankEkstre02062194872448750221348.exe
1864	HalkbankEkstre02062194872448750221348.exe
1824	HalkbankEkstre02062194872448750221348.exe
932	HalkbankEkstre02062194872448750221348.exe
932	HalkbankEkstre02062194872448750221348.exe
1952	HalkbankEkstre02062194872448750221348.exe
628	HalkbankEkstre02062194872448750221348.exe
900	HalkbankEkstre02062194872448750221348.exe
944	HalkbankEkstre02062194872448750221348.exe
1956	HalkbankEkstre02062194872448750221348.exe
1956	HalkbankEkstre02062194872448750221348.exe
1628	HalkbankEkstre02062194872448750221348.exe
464	HalkbankEkstre02062194872448750221348.exe
1660	HalkbankEkstre02062194872448750221348.exe
1660	HalkbankEkstre02062194872448750221348.exe
1060	HalkbankEkstre02062194872448750221348.exe
1548	HalkbankEkstre02062194872448750221348.exe
1548	HalkbankEkstre02062194872448750221348.exe
860	HalkbankEkstre02062194872448750221348.exe
860	HalkbankEkstre02062194872448750221348.exe
1504	HalkbankEkstre02062194872448750221348.exe
1084	HalkbankEkstre02062194872448750221348.exe
1652	HalkbankEkstre02062194872448750221348.exe
1652	HalkbankEkstre02062194872448750221348.exe
1740	HalkbankEkstre02062194872448750221348.exe
1740	HalkbankEkstre02062194872448750221348.exe
1004	HalkbankEkstre02062194872448750221348.exe
1092	HalkbankEkstre02062194872448750221348.exe
1472	HalkbankEkstre02062194872448750221348.exe
1700	HalkbankEkstre02062194872448750221348.exe
556	HalkbankEkstre02062194872448750221348.exe
1636	HalkbankEkstre02062194872448750221348.exe
2016	HalkbankEkstre02062194872448750221348.exe
1036	HalkbankEkstre02062194872448750221348.exe
1988	HalkbankEkstre02062194872448750221348.exe
1056	HalkbankEkstre02062194872448750221348.exe
1656	HalkbankEkstre02062194872448750221348.exe
1548	HalkbankEkstre02062194872448750221348.exe
1548	HalkbankEkstre02062194872448750221348.exe
1768	HalkbankEkstre02062194872448750221348.exe
820	HalkbankEkstre02062194872448750221348.exe
1992	HalkbankEkstre02062194872448750221348.exe
1132	HalkbankEkstre02062194872448750221348.exe
1132	HalkbankEkstre02062194872448750221348.exe
1732	HalkbankEkstre02062194872448750221348.exe
1732	HalkbankEkstre02062194872448750221348.exe
308	HalkbankEkstre02062194872448750221348.exe
628	HalkbankEkstre02062194872448750221348.exe
628	HalkbankEkstre02062194872448750221348.exe
1728	HalkbankEkstre02062194872448750221348.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2012	1956	HalkbankEkstre02062194872448750221348.exe	26
PID 1956 wrote to memory of 2012	1956	HalkbankEkstre02062194872448750221348.exe	26
PID 1956 wrote to memory of 2012	1956	HalkbankEkstre02062194872448750221348.exe	26
PID 1956 wrote to memory of 2012	1956	HalkbankEkstre02062194872448750221348.exe	26
PID 1956 wrote to memory of 2012	1956	HalkbankEkstre02062194872448750221348.exe	26
PID 1956 wrote to memory of 1576	1956	HalkbankEkstre02062194872448750221348.exe	30
PID 1956 wrote to memory of 1576	1956	HalkbankEkstre02062194872448750221348.exe	30
PID 1956 wrote to memory of 1576	1956	HalkbankEkstre02062194872448750221348.exe	30
PID 1956 wrote to memory of 1576	1956	HalkbankEkstre02062194872448750221348.exe	30
PID 1576 wrote to memory of 1568	1576	HalkbankEkstre02062194872448750221348.exe	31
PID 1576 wrote to memory of 1568	1576	HalkbankEkstre02062194872448750221348.exe	31
PID 1576 wrote to memory of 1568	1576	HalkbankEkstre02062194872448750221348.exe	31
PID 1576 wrote to memory of 1568	1576	HalkbankEkstre02062194872448750221348.exe	31
PID 1576 wrote to memory of 1568	1576	HalkbankEkstre02062194872448750221348.exe	31
PID 1576 wrote to memory of 996	1576	HalkbankEkstre02062194872448750221348.exe	32
PID 1576 wrote to memory of 996	1576	HalkbankEkstre02062194872448750221348.exe	32
PID 1576 wrote to memory of 996	1576	HalkbankEkstre02062194872448750221348.exe	32
PID 1576 wrote to memory of 996	1576	HalkbankEkstre02062194872448750221348.exe	32
PID 996 wrote to memory of 892	996	HalkbankEkstre02062194872448750221348.exe	33
PID 996 wrote to memory of 892	996	HalkbankEkstre02062194872448750221348.exe	33
PID 996 wrote to memory of 892	996	HalkbankEkstre02062194872448750221348.exe	33
PID 996 wrote to memory of 892	996	HalkbankEkstre02062194872448750221348.exe	33
PID 996 wrote to memory of 892	996	HalkbankEkstre02062194872448750221348.exe	33
PID 996 wrote to memory of 1036	996	HalkbankEkstre02062194872448750221348.exe	34
PID 996 wrote to memory of 1036	996	HalkbankEkstre02062194872448750221348.exe	34
PID 996 wrote to memory of 1036	996	HalkbankEkstre02062194872448750221348.exe	34
PID 996 wrote to memory of 1036	996	HalkbankEkstre02062194872448750221348.exe	34
PID 1036 wrote to memory of 1544	1036	HalkbankEkstre02062194872448750221348.exe	35
PID 1036 wrote to memory of 1544	1036	HalkbankEkstre02062194872448750221348.exe	35
PID 1036 wrote to memory of 1544	1036	HalkbankEkstre02062194872448750221348.exe	35
PID 1036 wrote to memory of 1544	1036	HalkbankEkstre02062194872448750221348.exe	35
PID 1036 wrote to memory of 1544	1036	HalkbankEkstre02062194872448750221348.exe	35
PID 1036 wrote to memory of 1864	1036	HalkbankEkstre02062194872448750221348.exe	36
PID 1036 wrote to memory of 1864	1036	HalkbankEkstre02062194872448750221348.exe	36
PID 1036 wrote to memory of 1864	1036	HalkbankEkstre02062194872448750221348.exe	36
PID 1036 wrote to memory of 1864	1036	HalkbankEkstre02062194872448750221348.exe	36
PID 1864 wrote to memory of 1800	1864	HalkbankEkstre02062194872448750221348.exe	37
PID 1864 wrote to memory of 1800	1864	HalkbankEkstre02062194872448750221348.exe	37
PID 1864 wrote to memory of 1800	1864	HalkbankEkstre02062194872448750221348.exe	37
PID 1864 wrote to memory of 1800	1864	HalkbankEkstre02062194872448750221348.exe	37
PID 1864 wrote to memory of 1800	1864	HalkbankEkstre02062194872448750221348.exe	37
PID 1864 wrote to memory of 1824	1864	HalkbankEkstre02062194872448750221348.exe	38
PID 1864 wrote to memory of 1824	1864	HalkbankEkstre02062194872448750221348.exe	38
PID 1864 wrote to memory of 1824	1864	HalkbankEkstre02062194872448750221348.exe	38
PID 1864 wrote to memory of 1824	1864	HalkbankEkstre02062194872448750221348.exe	38
PID 1824 wrote to memory of 1016	1824	HalkbankEkstre02062194872448750221348.exe	39
PID 1824 wrote to memory of 1016	1824	HalkbankEkstre02062194872448750221348.exe	39
PID 1824 wrote to memory of 1016	1824	HalkbankEkstre02062194872448750221348.exe	39
PID 1824 wrote to memory of 1016	1824	HalkbankEkstre02062194872448750221348.exe	39
PID 1824 wrote to memory of 1016	1824	HalkbankEkstre02062194872448750221348.exe	39
PID 1824 wrote to memory of 932	1824	HalkbankEkstre02062194872448750221348.exe	40
PID 1824 wrote to memory of 932	1824	HalkbankEkstre02062194872448750221348.exe	40
PID 1824 wrote to memory of 932	1824	HalkbankEkstre02062194872448750221348.exe	40
PID 1824 wrote to memory of 932	1824	HalkbankEkstre02062194872448750221348.exe	40
PID 932 wrote to memory of 1172	932	HalkbankEkstre02062194872448750221348.exe	41
PID 932 wrote to memory of 1172	932	HalkbankEkstre02062194872448750221348.exe	41
PID 932 wrote to memory of 1172	932	HalkbankEkstre02062194872448750221348.exe	41
PID 932 wrote to memory of 1172	932	HalkbankEkstre02062194872448750221348.exe	41
PID 932 wrote to memory of 1952	932	HalkbankEkstre02062194872448750221348.exe	42
PID 932 wrote to memory of 1952	932	HalkbankEkstre02062194872448750221348.exe	42
PID 932 wrote to memory of 1952	932	HalkbankEkstre02062194872448750221348.exe	42
PID 932 wrote to memory of 1952	932	HalkbankEkstre02062194872448750221348.exe	42
PID 1952 wrote to memory of 1268	1952	HalkbankEkstre02062194872448750221348.exe	43
PID 1952 wrote to memory of 1268	1952	HalkbankEkstre02062194872448750221348.exe	43

C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
"C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
  2⤵
  PID:2012
- C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
  "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
    "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
      4⤵
      PID:892
  - - C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
      "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
      4⤵
      Loads dropped DLL
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1036
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        5⤵
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        5⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1864
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        6⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        6⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        7⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        7⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        8⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        8⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1952
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        9⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        9⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:628
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        10⤵
        
        PID:308
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        10⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:900
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        11⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        11⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:944
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        12⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        12⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1956
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        13⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        13⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1628
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        14⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        14⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:464
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        15⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        15⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1660
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        16⤵
        
        PID:612
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        16⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1060
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        17⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        17⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1548
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        18⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        18⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:860
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        19⤵
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        19⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1504
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        20⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        20⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1084
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        21⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        21⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1652
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        22⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        22⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1740
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        23⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        23⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1004
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        24⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        24⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1092
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        25⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        25⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1472
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        26⤵
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        26⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1700
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        27⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        27⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:556
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        28⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        28⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1636
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        29⤵
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        29⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:2016
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        30⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        30⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1036
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        31⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        31⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1988
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        32⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        32⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1056
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        33⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        33⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1656
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        34⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        34⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1548
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        35⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        35⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1768
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        36⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        36⤵
        Suspicious behavior: MapViewOfSection
        
        PID:820
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        37⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        37⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1992
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        38⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        38⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1132
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        39⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        39⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1732
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        40⤵
        
        PID:1140
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        40⤵
        Suspicious behavior: MapViewOfSection
        
        PID:308
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        41⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        41⤵
        Suspicious behavior: MapViewOfSection
        
        PID:628
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        42⤵
        
        PID:740
        
        C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        42⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1728
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HalkbankEkstre02062194872448750221348.exe"
        43⤵
        
        PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-60-0x0000000075801000-0x0000000075803000-memory.dmp

Download