Overview

overview

10

Static

static

10

Ziraat Ban...ji.exe

windows7_x64

10

Ziraat Ban...ji.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 00:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ziraat Bankasi Swift Messaji.exe

  • Size

    1.3MB

  • MD5

    7ba9c730b33fd37be0eec329aabeb6a0

  • SHA1

    eabc80e887de547dc8dd16d4d0a515df48f30791

  • SHA256

    30dac0d69e366db4ce57a0935d5619e4bcebfcbaa9f14b7618970cc2aaa522f4

  • SHA512

    a8ac548c69d3698c87a18291577e6ddc3912c6009878382c3b1bc83cd3ad2b96f39cd60f797a60ae75bb992c413dc35a6f2a4fb844640a621cf88d75a93381fc

Score
10/10
massloggerpersistencespywarestealer

Malware Config

Signatures

  • MassLogger

    Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

    stealerspywaremasslogger
  • MassLogger Main Payload 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Messaji.exe
    "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Messaji.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v admin /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v admin /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\.exe"
        3⤵
        • Adds Run key to start application
        PID:1460
    • C:\Users\Admin\Desktop\.exe
      "C:\Users\Admin\Desktop\.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5036
      • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
        "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
        3⤵
        • Executes dropped EXE
        PID:3860

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
    Filesize

    63KB

    MD5

    0d5df43af2916f47d00c1573797c1a13

    SHA1

    230ab5559e806574d26b4c20847c368ed55483b0

    SHA256

    c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

    SHA512

    f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
    Filesize

    63KB

    MD5

    0d5df43af2916f47d00c1573797c1a13

    SHA1

    230ab5559e806574d26b4c20847c368ed55483b0

    SHA256

    c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

    SHA512

    f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

    Download Submit

  • C:\Users\Admin\Desktop\.exe
    Filesize

    1.3MB

    MD5

    7ba9c730b33fd37be0eec329aabeb6a0

    SHA1

    eabc80e887de547dc8dd16d4d0a515df48f30791

    SHA256

    30dac0d69e366db4ce57a0935d5619e4bcebfcbaa9f14b7618970cc2aaa522f4

    SHA512

    a8ac548c69d3698c87a18291577e6ddc3912c6009878382c3b1bc83cd3ad2b96f39cd60f797a60ae75bb992c413dc35a6f2a4fb844640a621cf88d75a93381fc

    Download Submit

  • C:\Users\Admin\Desktop\.exe
    Filesize

    1.3MB

    MD5

    7ba9c730b33fd37be0eec329aabeb6a0

    SHA1

    eabc80e887de547dc8dd16d4d0a515df48f30791

    SHA256

    30dac0d69e366db4ce57a0935d5619e4bcebfcbaa9f14b7618970cc2aaa522f4

    SHA512

    a8ac548c69d3698c87a18291577e6ddc3912c6009878382c3b1bc83cd3ad2b96f39cd60f797a60ae75bb992c413dc35a6f2a4fb844640a621cf88d75a93381fc

    Download Submit

  • memory/1460-135-0x0000000000000000-mapping.dmp

    Download

  • memory/1708-134-0x0000000000000000-mapping.dmp

    Download

  • memory/1876-130-0x00000000007A0000-0x00000000008F0000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1876-131-0x0000000007CA0000-0x0000000008244000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/1876-132-0x0000000007790000-0x0000000007822000-memory.dmp

    Filesize

    584KB

    Download

  • memory/1876-133-0x0000000007830000-0x0000000007874000-memory.dmp

    Filesize

    272KB

    Download

  • memory/3860-139-0x0000000000000000-mapping.dmp

    Download

  • memory/5036-136-0x0000000000000000-mapping.dmp

    Download