Analysis
-
max time kernel
146s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-01-2023 10:22
Static task
static1
Behavioral task
behavioral1
Sample
Halkbank,pdf.exe
Resource
win7-20220812-en
General
-
Target
Halkbank,pdf.exe
-
Size
748KB
-
MD5
3e0ff29b04ce9b6ca93fe26eae5ea271
-
SHA1
c9c29504bd24e3c7ac591ec1312e32a9c5623a3f
-
SHA256
f79a020cedb43bbd1f4948a2566d081fed934d56f871741d2548f792e8800e7b
-
SHA512
3e9e18cd7addfa2b7cf8cfc4ccb5bc7da55ff2951c72456dd57b653e239cbbabc265871da0674a8f9251150b94ba045aa95f2413669dac4163f21fabeb5046f9
-
SSDEEP
12288:k9posleqpoUIGApUa0h3hnzEcWjPX8UBhxE1q1feA+rsnKrFEcFXL1GH/h8:kEsMzG9Zhz0rDDxQq1febr
Malware Config
Extracted
formbook
4.1
gg62
growfast.africa
lerema.com
38945.se
wheelfermotors.africa
giftshareforyou.online
burrismktg.com
keepgrowing.uk
efefhomeless.buzz
bryanokoh.com
fashion-clothing-40094.com
andreasunshine.com
naijahood.africa
aditrirealty.com
kinnoitodatsumou.com
cryptoqzclimax.com
hairly.biz
comeuphither4.com
integrity360.ltd
flushywhole.com
8869365.com
fabvance-demos.online
motherpearl.africa
dnsmctmu.com
25779.football
crimson-sunset.ru
haamyounghoon.com
0563news.com
battleb0t.site
transnetfreight.africa
djdaxroadshow.co.uk
bwrps.live
abuin.vip
impressionsbyb.store
findguyscolorado.com
jordanflowerauction.net
fdm50off.com
31seaaa.com
centuryofviolence.co.uk
againstszhanweek.com
injurylawyersconsultants.com
kuotabike.com
cruisejoy.uk
clotaire.ru
hurloic.xyz
anvair.com
ivapeonthis.com
hotsesso.xyz
khramvyazovki.store
mentalistas.dev
cahayasunnah.com
bypro1.online
flavoredkreations.info
inuwallet.com
livingemployebenefits.com
enlighthings.com
focobreathwork.com
emaskhalipahbertam.com
jswl.store
chamaera.com
abbeyspear.com
downwind.one
lovelive.buzz
essentialhealth101.com
irakit.com
cbsht.com
Signatures
-
Formbook payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1504-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1504-64-0x000000000041F0B0-mapping.dmp formbook behavioral1/memory/1504-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1504-75-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1772-78-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1772-82-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 684 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Halkbank,pdf.exeHalkbank,pdf.exeraserver.exedescription pid process target process PID 1884 set thread context of 1504 1884 Halkbank,pdf.exe Halkbank,pdf.exe PID 1504 set thread context of 1268 1504 Halkbank,pdf.exe Explorer.EXE PID 1504 set thread context of 1268 1504 Halkbank,pdf.exe Explorer.EXE PID 1772 set thread context of 1268 1772 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
Halkbank,pdf.exeraserver.exepid process 1504 Halkbank,pdf.exe 1504 Halkbank,pdf.exe 1504 Halkbank,pdf.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe 1772 raserver.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Halkbank,pdf.exeraserver.exepid process 1504 Halkbank,pdf.exe 1504 Halkbank,pdf.exe 1504 Halkbank,pdf.exe 1504 Halkbank,pdf.exe 1772 raserver.exe 1772 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Halkbank,pdf.exeraserver.exedescription pid process Token: SeDebugPrivilege 1504 Halkbank,pdf.exe Token: SeDebugPrivilege 1772 raserver.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Halkbank,pdf.exeHalkbank,pdf.exeraserver.exedescription pid process target process PID 1884 wrote to memory of 1504 1884 Halkbank,pdf.exe Halkbank,pdf.exe PID 1884 wrote to memory of 1504 1884 Halkbank,pdf.exe Halkbank,pdf.exe PID 1884 wrote to memory of 1504 1884 Halkbank,pdf.exe Halkbank,pdf.exe PID 1884 wrote to memory of 1504 1884 Halkbank,pdf.exe Halkbank,pdf.exe PID 1884 wrote to memory of 1504 1884 Halkbank,pdf.exe Halkbank,pdf.exe PID 1884 wrote to memory of 1504 1884 Halkbank,pdf.exe Halkbank,pdf.exe PID 1884 wrote to memory of 1504 1884 Halkbank,pdf.exe Halkbank,pdf.exe PID 1504 wrote to memory of 1772 1504 Halkbank,pdf.exe raserver.exe PID 1504 wrote to memory of 1772 1504 Halkbank,pdf.exe raserver.exe PID 1504 wrote to memory of 1772 1504 Halkbank,pdf.exe raserver.exe PID 1504 wrote to memory of 1772 1504 Halkbank,pdf.exe raserver.exe PID 1772 wrote to memory of 684 1772 raserver.exe cmd.exe PID 1772 wrote to memory of 684 1772 raserver.exe cmd.exe PID 1772 wrote to memory of 684 1772 raserver.exe cmd.exe PID 1772 wrote to memory of 684 1772 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Halkbank,pdf.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/684-76-0x0000000000000000-mapping.dmp
-
memory/1268-69-0x0000000006190000-0x0000000006250000-memory.dmpFilesize
768KB
-
memory/1268-83-0x0000000006B60000-0x0000000006CD3000-memory.dmpFilesize
1.4MB
-
memory/1268-81-0x0000000006B60000-0x0000000006CD3000-memory.dmpFilesize
1.4MB
-
memory/1268-72-0x0000000006A10000-0x0000000006B54000-memory.dmpFilesize
1.3MB
-
memory/1504-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1504-71-0x0000000000350000-0x0000000000364000-memory.dmpFilesize
80KB
-
memory/1504-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1504-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1504-64-0x000000000041F0B0-mapping.dmp
-
memory/1504-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1504-67-0x0000000000B60000-0x0000000000E63000-memory.dmpFilesize
3.0MB
-
memory/1504-68-0x0000000000290000-0x00000000002A4000-memory.dmpFilesize
80KB
-
memory/1504-75-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1772-73-0x0000000000000000-mapping.dmp
-
memory/1772-77-0x0000000000DD0000-0x0000000000DEC000-memory.dmpFilesize
112KB
-
memory/1772-78-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1772-79-0x00000000021F0000-0x00000000024F3000-memory.dmpFilesize
3.0MB
-
memory/1772-80-0x0000000000980000-0x0000000000A13000-memory.dmpFilesize
588KB
-
memory/1772-82-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1884-58-0x0000000005130000-0x00000000051A0000-memory.dmpFilesize
448KB
-
memory/1884-54-0x0000000000AA0000-0x0000000000B60000-memory.dmpFilesize
768KB
-
memory/1884-59-0x00000000009F0000-0x0000000000A26000-memory.dmpFilesize
216KB
-
memory/1884-57-0x0000000000560000-0x000000000056A000-memory.dmpFilesize
40KB
-
memory/1884-56-0x0000000000460000-0x0000000000470000-memory.dmpFilesize
64KB
-
memory/1884-55-0x0000000075201000-0x0000000075203000-memory.dmpFilesize
8KB