2b5e0eaa1ba6de90bb95dfb7a374b9a8f7052b109e670b900f4b0e3cc5a2896c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
T.HALK BANKASI A.Ş. 14.10.2022 Hesap Ekstresi.exe
Size 296KB
Sample260730-pjdfmaxcrd
SHA256 2b5e0eaa1ba6de90bb95dfb7a374b9a8f7052b109e670b900f4b0e3cc5a2896c
MD5 3ab5829c7af42cafaec6f593b1925358
SHA1 9ae8ceaf1094cdac9146e9fd9016fdcff7a8b828
SHA512 242bfa51ca915ae033cc6dfaa0bbc91496fc433293ed5822fda472e01cc9ec59136d3223dbfb61d1e541a2329dea3f765411a96b560584bf261f3c3884ca6642
SSDEEP 6144:mbE/HUbUh0V5l1uu9WTMYw2bKmNbM2zJkOj2E70WFCrCWwk:mb/Uh0uuAwd2b1NbBJpj2E4W8ZB
TLSH
T1A4542224FB1082A7D163173846776B57AFBBF51A10A0ED4B034057E87BB72C94A5F32A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4208	ruuaasgl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2440	4208	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	T.HALK BANKASI A.Ş. 14.10.2022 Hesap Ekstresi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ruuaasgl.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4208	5032	T.HALK BANKASI A.Ş. 14.10.2022 Hesap Ekstresi.exe	85

C:\Users\Admin\AppData\Local\Temp\T.HALK BANKASI A.Ş. 14.10.2022 Hesap Ekstresi.exe
"C:\Users\Admin\AppData\Local\Temp\T.HALK BANKASI A.Ş. 14.10.2022 Hesap Ekstresi.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\ruuaasgl.exe
  "C:\Users\Admin\AppData\Local\Temp\ruuaasgl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 656
    3⤵
    - Program crash
    PID:2440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4208 -ip 4208
1⤵
PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bgmplnvgw.dr

Path C:\Users\Admin\AppData\Local\Temp\bgmplnvgw.dr
Size 4KB
SHA256 5c2a56503f162169e7d79efafe2506c0a8cb775fbb2b17f86d17d787c3d007d8
MD5 8747220494110a489618e1c6b4284308
SHA1 68482be8a37973d2a0faebbd5a56f5c88ffd932c
SHA512 abf02447c3fcdbb9704be2755e77f04af3f07fd182eb19bf73512e48b0e5d01b7fa72113289e85f11a24c6bd57b5b362f49626b2b983dd8ae402de4586c293ef
SSDEEP 96:C9noYBj+kWl0ZhwTbrPVE2VmG5vZoDeXOSI9lcMhaoNvCLMGjZibQuLayC:Cpzdc0ZIPVz5aMAlfhaoMjZIf5C
TLSH
T1EDA19DBEDBA081DD41BD9E08895006A16FBCA687E0E2FD99F42E3533DF72D0B0806850
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qdpefynex.b

Path C:\Users\Admin\AppData\Local\Temp\qdpefynex.b
Size 185KB
SHA256 36692e8eba55a9bad005cd8ac0ffb8294f3f1feb58a3c175791b336fa4d30c3c
MD5 2310e26dd8b41169f9cbf0672440600c
SHA1 71024c06e74bca87f45bcf3cf2de373575e274ab
SHA512 e91e9d7a0dac600c4ddcc5b8d70e386b54cbbe7738d95fcaad18b992d9da366b9b0da8f1562041279ab9740bb40a60a60455f212bb838e2a97c3575610b7596e
SSDEEP 3072:rbUd4M79ochivFWyXpvZhczrdw5wrq9l4suBBXXDix37aOFZJBuvUKmNOuM5oBJO:W4WocpyizJw5wrqXcLXXgFhusKmNbM2y
TLSH
T166041289BFEE028736274B47C3DD6DEE86535E79A58D1E87A6BF18C14604040A9FD30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ruuaasgl.exe

Path C:\Users\Admin\AppData\Local\Temp\ruuaasgl.exe
Size 133KB
SHA256 4847e024e751c9e3c52cc8b1ed916a5603fc9feb2d85de6a0451444ff5550014
MD5 0d25200bf9fdf1c2e1a905603f6d63b9
SHA1 2e3044e973588592ad8011377fc8839ca1a87ddc
SHA512 46b43d00edd561402cd4be0a1518440ef0eaa551a4c6abb8b163cf93da1635c1bd3b3d229c59e9fe3df9eb3cfcb7abb221908225d5ff336ca44c1dc79b3de43f
SSDEEP 3072:ACsPEvMCi32nCnQCRkDs1nVZwTOguR0LSAQSy3/DH:A9PkKuKkDQPwTQXH
TLSH
T1D2D39E5131C2917FD972A97155688AE0C9AFFE312E548FCB634C253ECE382E14736D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4208-8-0x00000000008B0000-0x00000000008B2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads