30dac0d69e366db4ce57a0935d5619e4bcebfcbaa9f14b7618970cc2aaa522f4 | Triage

Analysis

max time kernel
133s
max time network
135s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 11:13

Sharing

Report Analysis Logs

General

Target

Ziraat Bankasi Swift Messaji.exe
Size

1.3MB
MD5

7ba9c730b33fd37be0eec329aabeb6a0
SHA1

eabc80e887de547dc8dd16d4d0a515df48f30791
SHA256

30dac0d69e366db4ce57a0935d5619e4bcebfcbaa9f14b7618970cc2aaa522f4
SHA512

a8ac548c69d3698c87a18291577e6ddc3912c6009878382c3b1bc83cd3ad2b96f39cd60f797a60ae75bb992c413dc35a6f2a4fb844640a621cf88d75a93381fc

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Ziraat Bankasi Swift Messaji.exe

description pid process

Token: SeDebugPrivilege 1508 Ziraat Bankasi Swift Messaji.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Ziraat Bankasi Swift Messaji.exe

pid process

1508 Ziraat Bankasi Swift Messaji.exe

C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Messaji.exe
"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Messaji.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...