a8e34f0afa9d78ee85eaea3f14d16dd9180d4adc10d82dbd857394d5e2b3d9d6

Analysis

max time kernel
107s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16/03/2023, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MT103 Halkbank,pdf.exe
Size 1.1MB
Sample230316-hfr2aahd95
SHA256 a8e34f0afa9d78ee85eaea3f14d16dd9180d4adc10d82dbd857394d5e2b3d9d6
MD5 d451fb6911a049381491c7571862bd9d
SHA1 fe7f41fe9cf3b25f507962613c1637c89dc9b88d
SHA512 406676c3f369978d2d7fe8f3e4ae5245a9d087f657100a676624f00bd764173b5f9dda414e58a3a7f96b4e74c3cfa84b829749086c362d86dfa887bf8857209a
SSDEEP 24576:IwKJTNYfcJD5a+x+NUeW/rN1Ei1HER1hI5Pg4r2PtQhL:FKFUg6NnWZ1EmHjws
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 1192	2036	MT103 Halkbank,pdf.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2036	MT103 Halkbank,pdf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	MT103 Halkbank,pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	MT103 Halkbank,pdf.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1192	MT103 Halkbank,pdf.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1196	2036	MT103 Halkbank,pdf.exe	28
PID 2036 wrote to memory of 1196	2036	MT103 Halkbank,pdf.exe	28
PID 2036 wrote to memory of 1196	2036	MT103 Halkbank,pdf.exe	28
PID 2036 wrote to memory of 1196	2036	MT103 Halkbank,pdf.exe	28
PID 2036 wrote to memory of 1192	2036	MT103 Halkbank,pdf.exe	29
PID 2036 wrote to memory of 1192	2036	MT103 Halkbank,pdf.exe	29
PID 2036 wrote to memory of 1192	2036	MT103 Halkbank,pdf.exe	29
PID 2036 wrote to memory of 1192	2036	MT103 Halkbank,pdf.exe	29
PID 2036 wrote to memory of 1192	2036	MT103 Halkbank,pdf.exe	29
PID 2036 wrote to memory of 1192	2036	MT103 Halkbank,pdf.exe	29
PID 2036 wrote to memory of 1192	2036	MT103 Halkbank,pdf.exe	29
PID 2036 wrote to memory of 1192	2036	MT103 Halkbank,pdf.exe	29
PID 2036 wrote to memory of 1192	2036	MT103 Halkbank,pdf.exe	29

C:\Users\Admin\AppData\Local\Temp\MT103 Halkbank,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\MT103 Halkbank,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\MT103 Halkbank,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\MT103 Halkbank,pdf.exe"
  2⤵
  PID:1196
- C:\Users\Admin\AppData\Local\Temp\MT103 Halkbank,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\MT103 Halkbank,pdf.exe"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-67-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1192-64-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1192-73-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1192-72-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1192-69-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1192-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1192-62-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1192-63-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2036-55-0x0000000004E10000-0x0000000004E50000-memory.dmp

Download

memory/2036-61-0x0000000005E40000-0x0000000005ECA000-memory.dmp

Download

memory/2036-60-0x00000000006E0000-0x00000000006E8000-memory.dmp

Download

memory/2036-59-0x0000000008090000-0x000000000818C000-memory.dmp

Download

memory/2036-54-0x0000000000040000-0x0000000000164000-memory.dmp

Download

memory/2036-58-0x0000000000500000-0x000000000050C000-memory.dmp

Download

memory/2036-57-0x0000000004E10000-0x0000000004E50000-memory.dmp

Download

memory/2036-56-0x0000000000530000-0x000000000054E000-memory.dmp

Download