Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2025, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
Halkbank Ekstre.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Halkbank Ekstre.exe
Resource
win10v2004-20241007-en
General
-
Target
Halkbank Ekstre.exe
-
Size
636KB
-
MD5
5ca0edb9c8da5f99b88f6a230a838ff7
-
SHA1
201063e16865940a4482139c8a22a4f7728a3f7f
-
SHA256
454cda22d2e5b8dec8f70c430c0c4cfec75b4d29885ef343e84b9a2265363601
-
SHA512
9e587ddad60decf3e5c4254f786b231fe52fa4e26a399fd657f635525e35abf6a15b4133b1ee61a519bef3896117d357c2c6d6fea5acdd971527d5b450db086f
-
SSDEEP
12288:+AFtkqjSR80CJK3nnh2Q6Egc5uyNT3XNzVYxk0F:+c8CJY2Q0c5uy9XvYxk
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.puragenicindia.com - Port:
587 - Username:
[email protected] - Password:
bobbyj2016@bobbyj2016@
Signatures
-
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger payload 1 IoCs
resource yara_rule behavioral2/memory/3984-11-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
Snakekeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2776 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation Halkbank Ekstre.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3160 set thread context of 3984 3160 Halkbank Ekstre.exe 100 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4152 3984 WerFault.exe 100 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Halkbank Ekstre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Halkbank Ekstre.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3160 Halkbank Ekstre.exe 3160 Halkbank Ekstre.exe 3160 Halkbank Ekstre.exe 3160 Halkbank Ekstre.exe 3984 Halkbank Ekstre.exe 2776 powershell.exe 2776 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3160 Halkbank Ekstre.exe Token: SeDebugPrivilege 3984 Halkbank Ekstre.exe Token: SeDebugPrivilege 2776 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3160 wrote to memory of 2776 3160 Halkbank Ekstre.exe 96 PID 3160 wrote to memory of 2776 3160 Halkbank Ekstre.exe 96 PID 3160 wrote to memory of 2776 3160 Halkbank Ekstre.exe 96 PID 3160 wrote to memory of 4704 3160 Halkbank Ekstre.exe 98 PID 3160 wrote to memory of 4704 3160 Halkbank Ekstre.exe 98 PID 3160 wrote to memory of 4704 3160 Halkbank Ekstre.exe 98 PID 3160 wrote to memory of 3920 3160 Halkbank Ekstre.exe 99 PID 3160 wrote to memory of 3920 3160 Halkbank Ekstre.exe 99 PID 3160 wrote to memory of 3920 3160 Halkbank Ekstre.exe 99 PID 3160 wrote to memory of 3984 3160 Halkbank Ekstre.exe 100 PID 3160 wrote to memory of 3984 3160 Halkbank Ekstre.exe 100 PID 3160 wrote to memory of 3984 3160 Halkbank Ekstre.exe 100 PID 3160 wrote to memory of 3984 3160 Halkbank Ekstre.exe 100 PID 3160 wrote to memory of 3984 3160 Halkbank Ekstre.exe 100 PID 3160 wrote to memory of 3984 3160 Halkbank Ekstre.exe 100 PID 3160 wrote to memory of 3984 3160 Halkbank Ekstre.exe 100 PID 3160 wrote to memory of 3984 3160 Halkbank Ekstre.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\Halkbank Ekstre.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank Ekstre.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Halkbank Ekstre.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Users\Admin\AppData\Local\Temp\Halkbank Ekstre.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank Ekstre.exe"2⤵PID:4704
-
-
C:\Users\Admin\AppData\Local\Temp\Halkbank Ekstre.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank Ekstre.exe"2⤵PID:3920
-
-
C:\Users\Admin\AppData\Local\Temp\Halkbank Ekstre.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank Ekstre.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 14883⤵
- Program crash
PID:4152
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3984 -ip 39841⤵PID:2076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82