Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7 -
submitted
31-07-2020 10:17
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat Bankasi Swift Mesaji.exe
Resource
win7
Behavioral task
behavioral2
Sample
Ziraat Bankasi Swift Mesaji.exe
Resource
win10v200722
General
-
Target
Ziraat Bankasi Swift Mesaji.exe
-
Size
1.5MB
-
MD5
ac000598bac3110f6f3ddba519435ad8
-
SHA1
c0959d7452226d7287bbcf6088ad2deb16eb7459
-
SHA256
114ba0c81a5ac12f589504d2693d6cb0a845e119bf305fc9eb7b8e756b385f91
-
SHA512
fb86cefd95e877181303a7c138efa709c02fd0a110d77caa98e41866cf667f9e7fa63b0ec2f1362292a3c9d4826dc06976c6f6ff7ebe4cdfddda0be87d68f713
Malware Config
Extracted
C:\Users\Admin\AppData\Local\E2C1E8F1FA\Log.txt
masslogger
Signatures
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exe.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 1496 Ziraat Bankasi Swift Mesaji.exe Token: SeDebugPrivilege 1860 .exe Token: SeDebugPrivilege 2012 AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exe.exeAddInProcess32.exepid process 1496 Ziraat Bankasi Swift Mesaji.exe 1496 Ziraat Bankasi Swift Mesaji.exe 1496 Ziraat Bankasi Swift Mesaji.exe 1860 .exe 1860 .exe 1860 .exe 2012 AddInProcess32.exe 2012 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.execmd.exe.exedescription pid process target process PID 1496 wrote to memory of 1048 1496 Ziraat Bankasi Swift Mesaji.exe cmd.exe PID 1496 wrote to memory of 1048 1496 Ziraat Bankasi Swift Mesaji.exe cmd.exe PID 1496 wrote to memory of 1048 1496 Ziraat Bankasi Swift Mesaji.exe cmd.exe PID 1496 wrote to memory of 1048 1496 Ziraat Bankasi Swift Mesaji.exe cmd.exe PID 1048 wrote to memory of 1512 1048 cmd.exe reg.exe PID 1048 wrote to memory of 1512 1048 cmd.exe reg.exe PID 1048 wrote to memory of 1512 1048 cmd.exe reg.exe PID 1048 wrote to memory of 1512 1048 cmd.exe reg.exe PID 1496 wrote to memory of 1860 1496 Ziraat Bankasi Swift Mesaji.exe .exe PID 1496 wrote to memory of 1860 1496 Ziraat Bankasi Swift Mesaji.exe .exe PID 1496 wrote to memory of 1860 1496 Ziraat Bankasi Swift Mesaji.exe .exe PID 1496 wrote to memory of 1860 1496 Ziraat Bankasi Swift Mesaji.exe .exe PID 1860 wrote to memory of 2012 1860 .exe AddInProcess32.exe PID 1860 wrote to memory of 2012 1860 .exe AddInProcess32.exe PID 1860 wrote to memory of 2012 1860 .exe AddInProcess32.exe PID 1860 wrote to memory of 2012 1860 .exe AddInProcess32.exe PID 1860 wrote to memory of 2012 1860 .exe AddInProcess32.exe PID 1860 wrote to memory of 2012 1860 .exe AddInProcess32.exe PID 1860 wrote to memory of 2012 1860 .exe AddInProcess32.exe PID 1860 wrote to memory of 2012 1860 .exe AddInProcess32.exe PID 1860 wrote to memory of 2012 1860 .exe AddInProcess32.exe -
Executes dropped EXE 2 IoCs
Processes:
.exeAddInProcess32.exepid process 1860 .exe 2012 AddInProcess32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AddInProcess32.exepid process 2012 AddInProcess32.exe -
MassLogger log file 1 IoCs
Detects a log file produced by MassLogger.
Processes:
yara_rule masslogger_log_file -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Loads dropped DLL 2 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exe.exepid process 1496 Ziraat Bankasi Swift Mesaji.exe 1860 .exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
.exedescription pid process target process PID 1860 set thread context of 2012 1860 .exe AddInProcess32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
AddInProcess32.exepid process 2012 AddInProcess32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\admin = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\Desktop\\.exe" reg.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org -
MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v admin /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v admin /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\.exe"3⤵
- Adds Run key to start application
-
C:\Users\Admin\Desktop\.exe"C:\Users\Admin\Desktop\.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
-
C:\Users\Admin\Desktop\.exe
-
C:\Users\Admin\Desktop\.exe
-
\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
-
\Users\Admin\Desktop\.exe
-
memory/1048-3-0x0000000000000000-mapping.dmp
-
memory/1496-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1512-4-0x0000000000000000-mapping.dmp
-
memory/1860-6-0x0000000000000000-mapping.dmp
-
memory/2012-14-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/2012-15-0x00000000004BB9CE-mapping.dmp
-
memory/2012-17-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB
-
memory/2012-18-0x0000000000400000-0x00000000004C0000-memory.dmpFilesize
768KB