Analysis
-
max time kernel
117s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 13:18
Static task
static1
Behavioral task
behavioral1
Sample
Halkbank.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Halkbank.exe
Resource
win10v2004-20240508-en
General
-
Target
Halkbank.exe
-
Size
871KB
-
MD5
8d4fb7606e6270b7190b97f382993b42
-
SHA1
c4f94218183dd65573fc143e2051b776c3c0e13d
-
SHA256
01053beaa477c1cbf38cd7914244da9e75a22f59568056048fefde017503226e
-
SHA512
01e9bbe174bb282a263b0f85d478e884186f2c8aa67f3a82af2bc1c27005817d40f43d64797cf96a30c6bba7766d8a0dffd1d2851f871abc1779ff1399cd7538
-
SSDEEP
12288:qnTq/B++r60H1qRrznXOdDU9k3CDOSeJot8EUpWLfM88vqXVjPM6boym+gm2xOKY:RBRrFVWrzsUAaOSeJoPxsyFrMWBm/D1
Malware Config
Signatures
-
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
-
MassLogger Main payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2760-12-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/2760-20-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/2760-23-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/2760-18-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger behavioral1/memory/2760-14-0x0000000000400000-0x0000000000486000-memory.dmp family_masslogger -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Halkbank.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\International\Geo\Nation Halkbank.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
Processes:
Halkbank.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook Halkbank.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook Halkbank.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Halkbank.exe Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook Halkbank.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook Halkbank.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Halkbank.exedescription pid process target process PID 2196 set thread context of 2760 2196 Halkbank.exe Halkbank.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
Halkbank.exepid process 2760 Halkbank.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Halkbank.exeHalkbank.exepowershell.exepid process 2196 Halkbank.exe 2196 Halkbank.exe 2760 Halkbank.exe 2760 Halkbank.exe 2760 Halkbank.exe 2760 Halkbank.exe 2908 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Halkbank.exeHalkbank.exepowershell.exedescription pid process Token: SeDebugPrivilege 2196 Halkbank.exe Token: SeDebugPrivilege 2760 Halkbank.exe Token: SeDebugPrivilege 2908 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Halkbank.exepid process 2760 Halkbank.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Halkbank.exeHalkbank.exedescription pid process target process PID 2196 wrote to memory of 2760 2196 Halkbank.exe Halkbank.exe PID 2196 wrote to memory of 2760 2196 Halkbank.exe Halkbank.exe PID 2196 wrote to memory of 2760 2196 Halkbank.exe Halkbank.exe PID 2196 wrote to memory of 2760 2196 Halkbank.exe Halkbank.exe PID 2196 wrote to memory of 2760 2196 Halkbank.exe Halkbank.exe PID 2196 wrote to memory of 2760 2196 Halkbank.exe Halkbank.exe PID 2196 wrote to memory of 2760 2196 Halkbank.exe Halkbank.exe PID 2196 wrote to memory of 2760 2196 Halkbank.exe Halkbank.exe PID 2196 wrote to memory of 2760 2196 Halkbank.exe Halkbank.exe PID 2760 wrote to memory of 2908 2760 Halkbank.exe powershell.exe PID 2760 wrote to memory of 2908 2760 Halkbank.exe powershell.exe PID 2760 wrote to memory of 2908 2760 Halkbank.exe powershell.exe PID 2760 wrote to memory of 2908 2760 Halkbank.exe powershell.exe -
outlook_office_path 1 IoCs
Processes:
Halkbank.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe -
outlook_win_path 1 IoCs
Processes:
Halkbank.exedescription ioc process Key queried \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Halkbank.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Halkbank.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Halkbank.exe"{path}"2⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Halkbank.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2196-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmpFilesize
4KB
-
memory/2196-1-0x0000000000BB0000-0x0000000000C90000-memory.dmpFilesize
896KB
-
memory/2196-2-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB
-
memory/2196-3-0x0000000000640000-0x0000000000652000-memory.dmpFilesize
72KB
-
memory/2196-4-0x0000000074BDE000-0x0000000074BDF000-memory.dmpFilesize
4KB
-
memory/2196-5-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB
-
memory/2196-6-0x00000000080A0000-0x000000000813C000-memory.dmpFilesize
624KB
-
memory/2196-7-0x0000000008140000-0x00000000081DA000-memory.dmpFilesize
616KB
-
memory/2196-25-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB
-
memory/2760-20-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/2760-12-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/2760-23-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/2760-18-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/2760-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2760-14-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/2760-10-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/2760-24-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB
-
memory/2760-9-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/2760-26-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB
-
memory/2760-27-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB
-
memory/2760-30-0x0000000074BD0000-0x00000000752BE000-memory.dmpFilesize
6.9MB