853c6b9f5a239c8835602377968398c1c705224ccc4ad035a1529f047ef4d2b1

Analysis

Target

T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe
Size

811KB
MD5

826de0fd25130a7c0a79cb47d1cd10d1
SHA1

1d6cd2a23a0f9d17bf7481bd8380fa500deff528
SHA256

75bdc371b036b0305280360996f8b060f89b1aa6e840f0fd96afd2bfba151104
SHA512

1aff7e3b627b0dc60ae9b917347c06f0d2cf23f5f79a6a816e296ac85d10ed15e47b8ee874d5a0b9a7d3ee9e3b159b5b22c169fae382651fb7a8deacf6605dae

Score

4^/10

Drops file in Windows directory 6 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeShutdownPrivilege	4036	svchost.exe
Token: SeCreatePagefilePrivilege	4036	svchost.exe
Token: SeShutdownPrivilege	4036	svchost.exe
Token: SeCreatePagefilePrivilege	4036	svchost.exe
Token: SeShutdownPrivilege	4036	svchost.exe
Token: SeCreatePagefilePrivilege	4036	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exefondue.exe

description	pid	process	target process
PID 3380 wrote to memory of 4676	3380	T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe	fondue.exe
PID 3380 wrote to memory of 4676	3380	T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe	fondue.exe
PID 3380 wrote to memory of 4676	3380	T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe	fondue.exe
PID 4676 wrote to memory of 1284	4676	fondue.exe	FonDUE.EXE
PID 4676 wrote to memory of 1284	4676	fondue.exe	FonDUE.EXE

C:\Users\Admin\AppData\Local\Temp\T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\T.HALK BANKASI A.S. 03.12.2020 - 04.06.2020 Hesap Ekstresi.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3380

C:\Windows\SysWOW64\fondue.exe
"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
2⤵
- Suspicious use of WriteProcessMemory
PID:4676

C:\Windows\system32\FonDUE.EXE
"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
3⤵
PID:1284

memory/4036-130-0x000001D5C0330000-0x000001D5C0340000-memory.dmp

Filesize
64KB

Download
memory/4036-131-0x000001D5C0390000-0x000001D5C03A0000-memory.dmp

Filesize
64KB

Download
memory/4036-132-0x000001D5C30B0000-0x000001D5C30B4000-memory.dmp

Filesize
16KB

Download