Analysis
-
max time kernel
186s -
max time network
202s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 20:58
Static task
static1
Behavioral task
behavioral1
Sample
Halkbank_Ekstre_20220128_081138_756957 (1).exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Halkbank_Ekstre_20220128_081138_756957 (1).exe
Resource
win10-en-20211208
General
-
Target
Halkbank_Ekstre_20220128_081138_756957 (1).exe
-
Size
17KB
-
MD5
749aaf49615aa07edc9755541b213a4a
-
SHA1
8e856cae4e8d14c7d37f5d8342fc2d30acfede64
-
SHA256
d47bd2ff5d90d64d18485203e59a952e485a39f98e3d54258a578b13d9136ae7
-
SHA512
a3b731a35b418ab43efc8d09e2373bb659dc78fa8408fa6edc6da66d13e03f13228b6db22eab4a47be96a99c162c09d01565182e3684e61a0fa017e9c7b4f7b7
Malware Config
Extracted
xloader
2.5
po6r
jnhuichuangxin.com
mubashir.art
extol.design
doyyindh.xyz
milanoautoexperts.com
4thefringe.com
453511.com
sellathonautocredit.com
velgian.com
6672pk.com
wodeluzhou.com
sumiyoshiku-hizaita.xyz
imoveldeprimeira.com
dgjssp.com
endokc.com
side-clicks.com
cashndashfinancial.com
vanhemelryck.info
agamitrading.com
woofgang.xyz
atnetworkinc.com
malleshtekumatla.com
com-home.xyz
buildyourmtg.com
viairazur.xyz
drproteaches.com
amaznsavings.com
karencharlestonrealtor.com
bootstrategy.com
mimtgexpert.com
sebzvault.com
brtaclub.com
gicarellc.com
annehonorato.com
rafalgar.com
bergenyouthorchestra.com
entrevistasesenciales.com
thekneedoctors.com
grosseilemireal.estate
celestialdrone.art
bouwdrogerhurenvlaanderen.com
koppakart.com
irishykater.quest
blinglj.com
editorparmindersingh.com
klnhanced.quest
divinebehaviorsolutions.com
amprope.com
futuracart.com
ditrhub.com
eaoeducationprogramme.com
smartplumbing.services
revelandlaceevents.com
bikedh.xyz
pacificdevelopmentstudio.com
palisadesskivacation.com
happy-pets.xyz
killyourselfnigger.com
sonicdrillinginstitute.com
alibabascientific.com
sh-leming.com
aseelrealestate.com
lohmueller.gmbh
ngoccompany.com
healthonline.store
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
Halkbank_Ekstre_20220128_081138_756957 (1).exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\verify.exe\"," Halkbank_Ekstre_20220128_081138_756957 (1).exe -
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1048-140-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1048-143-0x00000000015D0000-0x0000000001761000-memory.dmp xloader behavioral2/memory/1560-146-0x0000000002800000-0x0000000002829000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Halkbank_Ekstre_20220128_081138_756957 (1).exeHalkbank_Ekstre_20220128_081138_756957 (1).exewlanext.exedescription pid process target process PID 2708 set thread context of 1048 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe Halkbank_Ekstre_20220128_081138_756957 (1).exe PID 1048 set thread context of 3032 1048 Halkbank_Ekstre_20220128_081138_756957 (1).exe Explorer.EXE PID 1560 set thread context of 3032 1560 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
powershell.exeHalkbank_Ekstre_20220128_081138_756957 (1).exeHalkbank_Ekstre_20220128_081138_756957 (1).exewlanext.exepid process 1488 powershell.exe 1488 powershell.exe 1488 powershell.exe 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe 1048 Halkbank_Ekstre_20220128_081138_756957 (1).exe 1048 Halkbank_Ekstre_20220128_081138_756957 (1).exe 1048 Halkbank_Ekstre_20220128_081138_756957 (1).exe 1048 Halkbank_Ekstre_20220128_081138_756957 (1).exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe 1560 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Halkbank_Ekstre_20220128_081138_756957 (1).exewlanext.exepid process 1048 Halkbank_Ekstre_20220128_081138_756957 (1).exe 1048 Halkbank_Ekstre_20220128_081138_756957 (1).exe 1048 Halkbank_Ekstre_20220128_081138_756957 (1).exe 1560 wlanext.exe 1560 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exeHalkbank_Ekstre_20220128_081138_756957 (1).exeHalkbank_Ekstre_20220128_081138_756957 (1).exewlanext.exedescription pid process Token: SeDebugPrivilege 1488 powershell.exe Token: SeDebugPrivilege 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe Token: SeDebugPrivilege 1048 Halkbank_Ekstre_20220128_081138_756957 (1).exe Token: SeDebugPrivilege 1560 wlanext.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Halkbank_Ekstre_20220128_081138_756957 (1).exeExplorer.EXEdescription pid process target process PID 2708 wrote to memory of 1488 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe powershell.exe PID 2708 wrote to memory of 1488 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe powershell.exe PID 2708 wrote to memory of 1488 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe powershell.exe PID 2708 wrote to memory of 3372 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe Halkbank_Ekstre_20220128_081138_756957 (1).exe PID 2708 wrote to memory of 3372 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe Halkbank_Ekstre_20220128_081138_756957 (1).exe PID 2708 wrote to memory of 3372 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe Halkbank_Ekstre_20220128_081138_756957 (1).exe PID 2708 wrote to memory of 1048 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe Halkbank_Ekstre_20220128_081138_756957 (1).exe PID 2708 wrote to memory of 1048 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe Halkbank_Ekstre_20220128_081138_756957 (1).exe PID 2708 wrote to memory of 1048 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe Halkbank_Ekstre_20220128_081138_756957 (1).exe PID 2708 wrote to memory of 1048 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe Halkbank_Ekstre_20220128_081138_756957 (1).exe PID 2708 wrote to memory of 1048 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe Halkbank_Ekstre_20220128_081138_756957 (1).exe PID 2708 wrote to memory of 1048 2708 Halkbank_Ekstre_20220128_081138_756957 (1).exe Halkbank_Ekstre_20220128_081138_756957 (1).exe PID 3032 wrote to memory of 1560 3032 Explorer.EXE wlanext.exe PID 3032 wrote to memory of 1560 3032 Explorer.EXE wlanext.exe PID 3032 wrote to memory of 1560 3032 Explorer.EXE wlanext.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20220128_081138_756957 (1).exe"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20220128_081138_756957 (1).exe"2⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc WwBUAGgAcgBlAGEAZABpAG4AZwAuAFQAaAByAGUAYQBkAF0AOgA6AFMAbABlAGUAcAAoADIAMAAwADAAMAApAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20220128_081138_756957 (1).exe"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20220128_081138_756957 (1).exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20220128_081138_756957 (1).exe"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20220128_081138_756957 (1).exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1048-140-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1048-143-0x00000000015D0000-0x0000000001761000-memory.dmpFilesize
1.6MB
-
memory/1048-142-0x0000000001770000-0x0000000001A90000-memory.dmpFilesize
3.1MB
-
memory/1488-126-0x0000000007CE0000-0x0000000007D46000-memory.dmpFilesize
408KB
-
memory/1488-121-0x0000000004980000-0x00000000049B6000-memory.dmpFilesize
216KB
-
memory/1488-125-0x0000000007310000-0x0000000007332000-memory.dmpFilesize
136KB
-
memory/1488-124-0x0000000004DF0000-0x0000000006F80000-memory.dmpFilesize
33.6MB
-
memory/1488-127-0x00000000074B0000-0x0000000007516000-memory.dmpFilesize
408KB
-
memory/1488-128-0x0000000007D50000-0x00000000080A0000-memory.dmpFilesize
3.3MB
-
memory/1488-129-0x0000000007590000-0x00000000075AC000-memory.dmpFilesize
112KB
-
memory/1488-130-0x00000000080A0000-0x00000000080EB000-memory.dmpFilesize
300KB
-
memory/1488-131-0x00000000084E0000-0x0000000008556000-memory.dmpFilesize
472KB
-
memory/1488-122-0x00000000075B0000-0x0000000007BD8000-memory.dmpFilesize
6.2MB
-
memory/1488-123-0x0000000004DF0000-0x0000000006F80000-memory.dmpFilesize
33.6MB
-
memory/1560-146-0x0000000002800000-0x0000000002829000-memory.dmpFilesize
164KB
-
memory/1560-145-0x0000000000040000-0x0000000000057000-memory.dmpFilesize
92KB
-
memory/1560-147-0x0000000002A50000-0x0000000002D70000-memory.dmpFilesize
3.1MB
-
memory/1560-148-0x00000000029C0000-0x0000000002A50000-memory.dmpFilesize
576KB
-
memory/2708-137-0x0000000005F10000-0x0000000005F58000-memory.dmpFilesize
288KB
-
memory/2708-138-0x0000000005F60000-0x0000000005FAC000-memory.dmpFilesize
304KB
-
memory/2708-139-0x0000000001040000-0x00000000010D2000-memory.dmpFilesize
584KB
-
memory/2708-136-0x0000000005CC0000-0x0000000005D4E000-memory.dmpFilesize
568KB
-
memory/2708-135-0x00000000059B0000-0x00000000059B1000-memory.dmpFilesize
4KB
-
memory/2708-118-0x0000000000830000-0x000000000083A000-memory.dmpFilesize
40KB
-
memory/3032-144-0x0000000001050000-0x0000000001146000-memory.dmpFilesize
984KB
-
memory/3032-149-0x0000000002D90000-0x0000000002E92000-memory.dmpFilesize
1.0MB