853c6b9f5a239c8835602377968398c1c705224ccc4ad035a1529f047ef4d2b1

Analysis

Target
T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe
Size 811KB
Sample220205-qqg8tsbgc8
SHA256 75bdc371b036b0305280360996f8b060f89b1aa6e840f0fd96afd2bfba151104
MD5 826de0fd25130a7c0a79cb47d1cd10d1
SHA1 1d6cd2a23a0f9d17bf7481bd8380fa500deff528
SHA512 1aff7e3b627b0dc60ae9b917347c06f0d2cf23f5f79a6a816e296ac85d10ed15e47b8ee874d5a0b9a7d3ee9e3b159b5b22c169fae382651fb7a8deacf6605dae
MD5 SHA1 SHA512

Score

4^/10

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4036	svchost.exe
Token: SeCreatePagefilePrivilege	4036	svchost.exe
Token: SeShutdownPrivilege	4036	svchost.exe
Token: SeCreatePagefilePrivilege	4036	svchost.exe
Token: SeShutdownPrivilege	4036	svchost.exe
Token: SeCreatePagefilePrivilege	4036	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 4676	3380	T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe	82
PID 3380 wrote to memory of 4676	3380	T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe	82
PID 3380 wrote to memory of 4676	3380	T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe	82
PID 4676 wrote to memory of 1284	4676	fondue.exe	83
PID 4676 wrote to memory of 1284	4676	fondue.exe	83

C:\Users\Admin\AppData\Local\Temp\T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\system32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:1284

memory/4036-130-0x000001D5C0330000-0x000001D5C0340000-memory.dmp

Download

memory/4036-131-0x000001D5C0390000-0x000001D5C03A0000-memory.dmp

Download

memory/4036-132-0x000001D5C30B0000-0x000001D5C30B4000-memory.dmp

Download