49c21b1c59f065d20fa66d292d4fd2709620449d422aef8d39fe4d4bd69f1d31

Analysis

max time kernel
147s
max time network
38s
platform
windows7_x64
resource
win7v20210408
submitted
31/05/2021, 13:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ziraat Bankasi Swift Mesaji.exe
Size 164KB
Sample210531-rmrmyj6s1e
SHA256 49c21b1c59f065d20fa66d292d4fd2709620449d422aef8d39fe4d4bd69f1d31
MD5 1cacda4d5632b80572097a042cd7f6e4
SHA1 e135080576f4e4d9a5dfb3d55bd46b8a4a840b87
SHA512 af538d8b18432f34588978d6b9101002bed09f2915e9362eb2bec5e85f03f8d36f156a81b43477eba49eb1b6b577e923e34693f6812f5aacfaa7d26023204cc3
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
752	Ziraat Bankasi Swift Mesaji.exe
752	Ziraat Bankasi Swift Mesaji.exe
1396	Ziraat Bankasi Swift Mesaji.exe
1396	Ziraat Bankasi Swift Mesaji.exe
472	Ziraat Bankasi Swift Mesaji.exe
472	Ziraat Bankasi Swift Mesaji.exe
1720	Ziraat Bankasi Swift Mesaji.exe
1720	Ziraat Bankasi Swift Mesaji.exe
1512	Ziraat Bankasi Swift Mesaji.exe
1512	Ziraat Bankasi Swift Mesaji.exe
1012	Ziraat Bankasi Swift Mesaji.exe
1012	Ziraat Bankasi Swift Mesaji.exe
836	Ziraat Bankasi Swift Mesaji.exe
836	Ziraat Bankasi Swift Mesaji.exe
1480	Ziraat Bankasi Swift Mesaji.exe
1480	Ziraat Bankasi Swift Mesaji.exe
1804	Ziraat Bankasi Swift Mesaji.exe
1804	Ziraat Bankasi Swift Mesaji.exe
1816	Ziraat Bankasi Swift Mesaji.exe
1816	Ziraat Bankasi Swift Mesaji.exe
1404	Ziraat Bankasi Swift Mesaji.exe
1404	Ziraat Bankasi Swift Mesaji.exe
1372	Ziraat Bankasi Swift Mesaji.exe
1372	Ziraat Bankasi Swift Mesaji.exe
988	Ziraat Bankasi Swift Mesaji.exe
988	Ziraat Bankasi Swift Mesaji.exe
620	Ziraat Bankasi Swift Mesaji.exe
620	Ziraat Bankasi Swift Mesaji.exe
1724	Ziraat Bankasi Swift Mesaji.exe
1724	Ziraat Bankasi Swift Mesaji.exe
1136	Ziraat Bankasi Swift Mesaji.exe
1136	Ziraat Bankasi Swift Mesaji.exe
1140	Ziraat Bankasi Swift Mesaji.exe
1140	Ziraat Bankasi Swift Mesaji.exe
1468	Ziraat Bankasi Swift Mesaji.exe
1468	Ziraat Bankasi Swift Mesaji.exe
824	Ziraat Bankasi Swift Mesaji.exe
824	Ziraat Bankasi Swift Mesaji.exe
944	Ziraat Bankasi Swift Mesaji.exe
944	Ziraat Bankasi Swift Mesaji.exe
1544	Ziraat Bankasi Swift Mesaji.exe
1544	Ziraat Bankasi Swift Mesaji.exe
1408	Ziraat Bankasi Swift Mesaji.exe
1408	Ziraat Bankasi Swift Mesaji.exe
1360	Ziraat Bankasi Swift Mesaji.exe
1360	Ziraat Bankasi Swift Mesaji.exe
1584	Ziraat Bankasi Swift Mesaji.exe
1584	Ziraat Bankasi Swift Mesaji.exe
1396	Ziraat Bankasi Swift Mesaji.exe
1396	Ziraat Bankasi Swift Mesaji.exe
612	Ziraat Bankasi Swift Mesaji.exe
612	Ziraat Bankasi Swift Mesaji.exe
760	Ziraat Bankasi Swift Mesaji.exe
760	Ziraat Bankasi Swift Mesaji.exe
1640	Ziraat Bankasi Swift Mesaji.exe
1640	Ziraat Bankasi Swift Mesaji.exe
1380	Ziraat Bankasi Swift Mesaji.exe
1380	Ziraat Bankasi Swift Mesaji.exe
1720	Ziraat Bankasi Swift Mesaji.exe
1720	Ziraat Bankasi Swift Mesaji.exe
1440	Ziraat Bankasi Swift Mesaji.exe
1440	Ziraat Bankasi Swift Mesaji.exe
860	Ziraat Bankasi Swift Mesaji.exe
860	Ziraat Bankasi Swift Mesaji.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 48 IoCs

pid	Process
752	Ziraat Bankasi Swift Mesaji.exe
752	Ziraat Bankasi Swift Mesaji.exe
1396	Ziraat Bankasi Swift Mesaji.exe
472	Ziraat Bankasi Swift Mesaji.exe
1720	Ziraat Bankasi Swift Mesaji.exe
1512	Ziraat Bankasi Swift Mesaji.exe
1012	Ziraat Bankasi Swift Mesaji.exe
1012	Ziraat Bankasi Swift Mesaji.exe
836	Ziraat Bankasi Swift Mesaji.exe
1480	Ziraat Bankasi Swift Mesaji.exe
1804	Ziraat Bankasi Swift Mesaji.exe
1804	Ziraat Bankasi Swift Mesaji.exe
1816	Ziraat Bankasi Swift Mesaji.exe
1816	Ziraat Bankasi Swift Mesaji.exe
1404	Ziraat Bankasi Swift Mesaji.exe
1372	Ziraat Bankasi Swift Mesaji.exe
988	Ziraat Bankasi Swift Mesaji.exe
620	Ziraat Bankasi Swift Mesaji.exe
1724	Ziraat Bankasi Swift Mesaji.exe
1724	Ziraat Bankasi Swift Mesaji.exe
1136	Ziraat Bankasi Swift Mesaji.exe
1140	Ziraat Bankasi Swift Mesaji.exe
1140	Ziraat Bankasi Swift Mesaji.exe
1468	Ziraat Bankasi Swift Mesaji.exe
824	Ziraat Bankasi Swift Mesaji.exe
944	Ziraat Bankasi Swift Mesaji.exe
1544	Ziraat Bankasi Swift Mesaji.exe
1408	Ziraat Bankasi Swift Mesaji.exe
1360	Ziraat Bankasi Swift Mesaji.exe
1584	Ziraat Bankasi Swift Mesaji.exe
1396	Ziraat Bankasi Swift Mesaji.exe
612	Ziraat Bankasi Swift Mesaji.exe
760	Ziraat Bankasi Swift Mesaji.exe
1640	Ziraat Bankasi Swift Mesaji.exe
1380	Ziraat Bankasi Swift Mesaji.exe
1720	Ziraat Bankasi Swift Mesaji.exe
1440	Ziraat Bankasi Swift Mesaji.exe
860	Ziraat Bankasi Swift Mesaji.exe
296	Ziraat Bankasi Swift Mesaji.exe
1944	Ziraat Bankasi Swift Mesaji.exe
1836	Ziraat Bankasi Swift Mesaji.exe
1836	Ziraat Bankasi Swift Mesaji.exe
1768	Ziraat Bankasi Swift Mesaji.exe
976	Ziraat Bankasi Swift Mesaji.exe
940	Ziraat Bankasi Swift Mesaji.exe
1296	Ziraat Bankasi Swift Mesaji.exe
1576	Ziraat Bankasi Swift Mesaji.exe
900	Ziraat Bankasi Swift Mesaji.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1272	752	Ziraat Bankasi Swift Mesaji.exe	29
PID 752 wrote to memory of 1272	752	Ziraat Bankasi Swift Mesaji.exe	29
PID 752 wrote to memory of 1272	752	Ziraat Bankasi Swift Mesaji.exe	29
PID 752 wrote to memory of 1272	752	Ziraat Bankasi Swift Mesaji.exe	29
PID 752 wrote to memory of 1396	752	Ziraat Bankasi Swift Mesaji.exe	30
PID 752 wrote to memory of 1396	752	Ziraat Bankasi Swift Mesaji.exe	30
PID 752 wrote to memory of 1396	752	Ziraat Bankasi Swift Mesaji.exe	30
PID 752 wrote to memory of 1396	752	Ziraat Bankasi Swift Mesaji.exe	30
PID 1396 wrote to memory of 524	1396	Ziraat Bankasi Swift Mesaji.exe	31
PID 1396 wrote to memory of 524	1396	Ziraat Bankasi Swift Mesaji.exe	31
PID 1396 wrote to memory of 524	1396	Ziraat Bankasi Swift Mesaji.exe	31
PID 1396 wrote to memory of 524	1396	Ziraat Bankasi Swift Mesaji.exe	31
PID 1396 wrote to memory of 524	1396	Ziraat Bankasi Swift Mesaji.exe	31
PID 1396 wrote to memory of 472	1396	Ziraat Bankasi Swift Mesaji.exe	32
PID 1396 wrote to memory of 472	1396	Ziraat Bankasi Swift Mesaji.exe	32
PID 1396 wrote to memory of 472	1396	Ziraat Bankasi Swift Mesaji.exe	32
PID 1396 wrote to memory of 472	1396	Ziraat Bankasi Swift Mesaji.exe	32
PID 472 wrote to memory of 1596	472	Ziraat Bankasi Swift Mesaji.exe	33
PID 472 wrote to memory of 1596	472	Ziraat Bankasi Swift Mesaji.exe	33
PID 472 wrote to memory of 1596	472	Ziraat Bankasi Swift Mesaji.exe	33
PID 472 wrote to memory of 1596	472	Ziraat Bankasi Swift Mesaji.exe	33
PID 472 wrote to memory of 1596	472	Ziraat Bankasi Swift Mesaji.exe	33
PID 472 wrote to memory of 1720	472	Ziraat Bankasi Swift Mesaji.exe	34
PID 472 wrote to memory of 1720	472	Ziraat Bankasi Swift Mesaji.exe	34
PID 472 wrote to memory of 1720	472	Ziraat Bankasi Swift Mesaji.exe	34
PID 472 wrote to memory of 1720	472	Ziraat Bankasi Swift Mesaji.exe	34
PID 1720 wrote to memory of 620	1720	Ziraat Bankasi Swift Mesaji.exe	35
PID 1720 wrote to memory of 620	1720	Ziraat Bankasi Swift Mesaji.exe	35
PID 1720 wrote to memory of 620	1720	Ziraat Bankasi Swift Mesaji.exe	35
PID 1720 wrote to memory of 620	1720	Ziraat Bankasi Swift Mesaji.exe	35
PID 1720 wrote to memory of 620	1720	Ziraat Bankasi Swift Mesaji.exe	35
PID 1720 wrote to memory of 1512	1720	Ziraat Bankasi Swift Mesaji.exe	36
PID 1720 wrote to memory of 1512	1720	Ziraat Bankasi Swift Mesaji.exe	36
PID 1720 wrote to memory of 1512	1720	Ziraat Bankasi Swift Mesaji.exe	36
PID 1720 wrote to memory of 1512	1720	Ziraat Bankasi Swift Mesaji.exe	36
PID 1512 wrote to memory of 1688	1512	Ziraat Bankasi Swift Mesaji.exe	37
PID 1512 wrote to memory of 1688	1512	Ziraat Bankasi Swift Mesaji.exe	37
PID 1512 wrote to memory of 1688	1512	Ziraat Bankasi Swift Mesaji.exe	37
PID 1512 wrote to memory of 1688	1512	Ziraat Bankasi Swift Mesaji.exe	37
PID 1512 wrote to memory of 1688	1512	Ziraat Bankasi Swift Mesaji.exe	37
PID 1512 wrote to memory of 1012	1512	Ziraat Bankasi Swift Mesaji.exe	38
PID 1512 wrote to memory of 1012	1512	Ziraat Bankasi Swift Mesaji.exe	38
PID 1512 wrote to memory of 1012	1512	Ziraat Bankasi Swift Mesaji.exe	38
PID 1512 wrote to memory of 1012	1512	Ziraat Bankasi Swift Mesaji.exe	38
PID 1012 wrote to memory of 1440	1012	Ziraat Bankasi Swift Mesaji.exe	39
PID 1012 wrote to memory of 1440	1012	Ziraat Bankasi Swift Mesaji.exe	39
PID 1012 wrote to memory of 1440	1012	Ziraat Bankasi Swift Mesaji.exe	39
PID 1012 wrote to memory of 1440	1012	Ziraat Bankasi Swift Mesaji.exe	39
PID 1012 wrote to memory of 836	1012	Ziraat Bankasi Swift Mesaji.exe	40
PID 1012 wrote to memory of 836	1012	Ziraat Bankasi Swift Mesaji.exe	40
PID 1012 wrote to memory of 836	1012	Ziraat Bankasi Swift Mesaji.exe	40
PID 1012 wrote to memory of 836	1012	Ziraat Bankasi Swift Mesaji.exe	40
PID 836 wrote to memory of 1468	836	Ziraat Bankasi Swift Mesaji.exe	41
PID 836 wrote to memory of 1468	836	Ziraat Bankasi Swift Mesaji.exe	41
PID 836 wrote to memory of 1468	836	Ziraat Bankasi Swift Mesaji.exe	41
PID 836 wrote to memory of 1468	836	Ziraat Bankasi Swift Mesaji.exe	41
PID 836 wrote to memory of 1468	836	Ziraat Bankasi Swift Mesaji.exe	41
PID 836 wrote to memory of 1480	836	Ziraat Bankasi Swift Mesaji.exe	42
PID 836 wrote to memory of 1480	836	Ziraat Bankasi Swift Mesaji.exe	42
PID 836 wrote to memory of 1480	836	Ziraat Bankasi Swift Mesaji.exe	42
PID 836 wrote to memory of 1480	836	Ziraat Bankasi Swift Mesaji.exe	42
PID 1480 wrote to memory of 960	1480	Ziraat Bankasi Swift Mesaji.exe	43
PID 1480 wrote to memory of 960	1480	Ziraat Bankasi Swift Mesaji.exe	43
PID 1480 wrote to memory of 960	1480	Ziraat Bankasi Swift Mesaji.exe	43

C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
  2⤵
  PID:1272
- C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
  "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
    3⤵
    PID:524
- - C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
    "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:472
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
      4⤵
      PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
      "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
      4⤵
      Loads dropped DLL
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:1720
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        5⤵
        
        PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        5⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1512
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        6⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1012
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        7⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        7⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        8⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        8⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1480
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        9⤵
        
        PID:960
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        9⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1804
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        10⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        10⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1816
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        11⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        11⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1404
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        12⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        12⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1372
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        13⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        13⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:988
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        14⤵
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        14⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:620
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        15⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        15⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1724
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        16⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        16⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1136
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        17⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        17⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1140
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        18⤵
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        18⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1468
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        19⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        19⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:824
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        20⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        20⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:944
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        21⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        21⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1544
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        22⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        22⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1408
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        23⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        23⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1360
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        24⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        24⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1584
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        25⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        25⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1396
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        26⤵
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        26⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:612
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        27⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        27⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:760
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        28⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        28⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1640
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        29⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        29⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1380
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        30⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        30⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1720
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        31⤵
        
        PID:336
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        31⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:1440
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        32⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        32⤵
        Loads dropped DLL
        Suspicious behavior: MapViewOfSection
        
        PID:860
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        33⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        33⤵
        Suspicious behavior: MapViewOfSection
        
        PID:296
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        34⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        34⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1944
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        35⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        35⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1836
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        36⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        36⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1768
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        37⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        37⤵
        Suspicious behavior: MapViewOfSection
        
        PID:976
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        38⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        38⤵
        Suspicious behavior: MapViewOfSection
        
        PID:940
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        39⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        39⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1296
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        40⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        40⤵
        Suspicious behavior: MapViewOfSection
        
        PID:1576
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        41⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        41⤵
        Suspicious behavior: MapViewOfSection
        
        PID:900
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"
        42⤵
        
        PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-60-0x0000000075451000-0x0000000075453000-memory.dmp

Download