Analysis
-
max time kernel
234s -
max time network
238s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 22:22
Static task
static1
Behavioral task
behavioral1
Sample
Halkbank,pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Halkbank,pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Halkbank,pdf.exe
-
Size
893KB
-
MD5
a7624902cc07011b5dadbcdd8267c9dc
-
SHA1
7d983b597b535d60123a773a1c40fcc14e0500b7
-
SHA256
c0cb41070b74fa0e592f10c6d5312e55009f1cc884bd1c242591bc75c5f9e5eb
-
SHA512
64487fd6dd327d119fe52a79bd3b2ad602a2a5be418ae97bba71642e03f9e46347ef140c70826a2fbafca570817e798c2d76e93139f98f43c14a6f7208a3ebe9
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/736-136-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Executes dropped EXE 3 IoCs
Processes:
vlc.exevlc.exevlc.exepid process 296 vlc.exe 1300 vlc.exe 4060 vlc.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Halkbank,pdf.exevlc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation Halkbank,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation vlc.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 42 IoCs
Processes:
vlc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook vlc.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook vlc.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\17.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\18.0\Outlook\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key opened \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\19.0\Outlook\Profiles\Outlook vlc.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 34 api.ipify.org 40 api.ipify.org -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Halkbank,pdf.exevlc.exedescription pid process target process PID 4484 set thread context of 736 4484 Halkbank,pdf.exe Halkbank,pdf.exe PID 296 set thread context of 4060 296 vlc.exe vlc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3828 timeout.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 4060 vlc.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
Halkbank,pdf.exeHalkbank,pdf.exevlc.exevlc.exepid process 4484 Halkbank,pdf.exe 4484 Halkbank,pdf.exe 4484 Halkbank,pdf.exe 4484 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 736 Halkbank,pdf.exe 296 vlc.exe 296 vlc.exe 296 vlc.exe 296 vlc.exe 296 vlc.exe 4060 vlc.exe 4060 vlc.exe 4060 vlc.exe 4060 vlc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Halkbank,pdf.exeHalkbank,pdf.exevlc.exevlc.exedescription pid process Token: SeDebugPrivilege 4484 Halkbank,pdf.exe Token: SeDebugPrivilege 736 Halkbank,pdf.exe Token: SeDebugPrivilege 296 vlc.exe Token: SeDebugPrivilege 4060 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 4060 vlc.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
Halkbank,pdf.exeHalkbank,pdf.execmd.execmd.exevlc.exedescription pid process target process PID 4484 wrote to memory of 736 4484 Halkbank,pdf.exe Halkbank,pdf.exe PID 4484 wrote to memory of 736 4484 Halkbank,pdf.exe Halkbank,pdf.exe PID 4484 wrote to memory of 736 4484 Halkbank,pdf.exe Halkbank,pdf.exe PID 4484 wrote to memory of 736 4484 Halkbank,pdf.exe Halkbank,pdf.exe PID 4484 wrote to memory of 736 4484 Halkbank,pdf.exe Halkbank,pdf.exe PID 4484 wrote to memory of 736 4484 Halkbank,pdf.exe Halkbank,pdf.exe PID 4484 wrote to memory of 736 4484 Halkbank,pdf.exe Halkbank,pdf.exe PID 4484 wrote to memory of 736 4484 Halkbank,pdf.exe Halkbank,pdf.exe PID 736 wrote to memory of 3836 736 Halkbank,pdf.exe cmd.exe PID 736 wrote to memory of 3836 736 Halkbank,pdf.exe cmd.exe PID 736 wrote to memory of 3836 736 Halkbank,pdf.exe cmd.exe PID 736 wrote to memory of 3820 736 Halkbank,pdf.exe cmd.exe PID 736 wrote to memory of 3820 736 Halkbank,pdf.exe cmd.exe PID 736 wrote to memory of 3820 736 Halkbank,pdf.exe cmd.exe PID 3836 wrote to memory of 2360 3836 cmd.exe schtasks.exe PID 3836 wrote to memory of 2360 3836 cmd.exe schtasks.exe PID 3836 wrote to memory of 2360 3836 cmd.exe schtasks.exe PID 3820 wrote to memory of 3828 3820 cmd.exe timeout.exe PID 3820 wrote to memory of 3828 3820 cmd.exe timeout.exe PID 3820 wrote to memory of 3828 3820 cmd.exe timeout.exe PID 3820 wrote to memory of 296 3820 cmd.exe vlc.exe PID 3820 wrote to memory of 296 3820 cmd.exe vlc.exe PID 3820 wrote to memory of 296 3820 cmd.exe vlc.exe PID 296 wrote to memory of 1300 296 vlc.exe vlc.exe PID 296 wrote to memory of 1300 296 vlc.exe vlc.exe PID 296 wrote to memory of 1300 296 vlc.exe vlc.exe PID 296 wrote to memory of 4060 296 vlc.exe vlc.exe PID 296 wrote to memory of 4060 296 vlc.exe vlc.exe PID 296 wrote to memory of 4060 296 vlc.exe vlc.exe PID 296 wrote to memory of 4060 296 vlc.exe vlc.exe PID 296 wrote to memory of 4060 296 vlc.exe vlc.exe PID 296 wrote to memory of 4060 296 vlc.exe vlc.exe PID 296 wrote to memory of 4060 296 vlc.exe vlc.exe PID 296 wrote to memory of 4060 296 vlc.exe vlc.exe -
outlook_office_path 1 IoCs
Processes:
vlc.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe -
outlook_win_path 1 IoCs
Processes:
vlc.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 vlc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"{path}"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn vlc.exe /tr '"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"' & exit3⤵
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn vlc.exe /tr '"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"'4⤵
- Creates scheduled task(s)
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp87E8.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
PID:3828 -
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"{path}"5⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Roaming\VideoLAN\vlc.exe"{path}"5⤵
- Executes dropped EXE
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:4060
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
156B
MD585eef1c9c1a76252f85e9632a8814f58
SHA1452a8389f3f804ea6b829427ab3556f7bc0fd56a
SHA256be8f4f92ec1c8cb6444d77135dfad3b84123566d1dc02de48053bfb6befc98f5
SHA5129e43ddecda681526d37db8087c3c558d852de62499314bae8482fea948a156673acdba5e508d3f7abef751f4185231b341f54ba5c6812e7b676649cf3fc1f6cd
-
Filesize
893KB
MD5a7624902cc07011b5dadbcdd8267c9dc
SHA17d983b597b535d60123a773a1c40fcc14e0500b7
SHA256c0cb41070b74fa0e592f10c6d5312e55009f1cc884bd1c242591bc75c5f9e5eb
SHA51264487fd6dd327d119fe52a79bd3b2ad602a2a5be418ae97bba71642e03f9e46347ef140c70826a2fbafca570817e798c2d76e93139f98f43c14a6f7208a3ebe9
-
Filesize
893KB
MD5a7624902cc07011b5dadbcdd8267c9dc
SHA17d983b597b535d60123a773a1c40fcc14e0500b7
SHA256c0cb41070b74fa0e592f10c6d5312e55009f1cc884bd1c242591bc75c5f9e5eb
SHA51264487fd6dd327d119fe52a79bd3b2ad602a2a5be418ae97bba71642e03f9e46347ef140c70826a2fbafca570817e798c2d76e93139f98f43c14a6f7208a3ebe9
-
Filesize
893KB
MD5a7624902cc07011b5dadbcdd8267c9dc
SHA17d983b597b535d60123a773a1c40fcc14e0500b7
SHA256c0cb41070b74fa0e592f10c6d5312e55009f1cc884bd1c242591bc75c5f9e5eb
SHA51264487fd6dd327d119fe52a79bd3b2ad602a2a5be418ae97bba71642e03f9e46347ef140c70826a2fbafca570817e798c2d76e93139f98f43c14a6f7208a3ebe9
-
Filesize
893KB
MD5a7624902cc07011b5dadbcdd8267c9dc
SHA17d983b597b535d60123a773a1c40fcc14e0500b7
SHA256c0cb41070b74fa0e592f10c6d5312e55009f1cc884bd1c242591bc75c5f9e5eb
SHA51264487fd6dd327d119fe52a79bd3b2ad602a2a5be418ae97bba71642e03f9e46347ef140c70826a2fbafca570817e798c2d76e93139f98f43c14a6f7208a3ebe9