Analysis
-
max time kernel
147s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-06-2022 12:30
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat Bankasi Swift Mesaji.exe
Resource
win7-20220414-en
General
-
Target
Ziraat Bankasi Swift Mesaji.exe
-
Size
691KB
-
MD5
82e5f8445f104069e52ac321d6deb453
-
SHA1
ea88106784cdd3de5f936242760c04a00ff90760
-
SHA256
b38804166eadbfa83edfbbb26115a35bc284af64a8e3429c3011a13965fdcbf2
-
SHA512
7495a30e490294124cb8adb58ca27cba56d4fd9b9289d8717cb59e3c51827844908c03c9c17fd82d7a4cfea530c7b21419bc5811fe299cb82f986ee7a1902338
Malware Config
Extracted
formbook
4.1
pr28
warehouseufohighbay.com
kingasia77.xyz
americanoutfittes.com
jemodaevangica.com
holigantv82.com
creamkidslife.com
skillzplanetoutreach.com
goldencityofficial.com
choiceaccessorise.com
kdgkzy.com
patra.tech
chicaglo.com
9491countyroad106.com
theultracleanser.com
lesmacarons.biz
kfaluminum.com
institutodiversidade.com
woodanqnmz.store
teslabuyerusa.com
cityofbastop.com
firegillibrand.com
npsyu5n-periv.com
nflstreams.pro
resuelve-deuda-latam-pro.com
281564.com
ezeehookz.com
rvestdewseherore.xyz
modderplaten.com
getdapp.xyz
tutsempire.com
scientiaimaging.com
cryptoriver-island.xyz
occidentalinn.net
decouvredesproduits.com
queensize.xyz
ipandu.net
yingxinyiyuan.com
suddeniink.com
guestwin.com
curahintstudio.xyz
5g00au.com
ncfirerestoration.com
diabeticlifeinsurancequotes.com
sex-intim-kropivnickiy.online
metashae.com
flora-kana.com
productsamerica.store
buliangdh90.xyz
georgiatourz.com
coveredbyaaa.com
wirethreepebble.com
jeffreygraper.com
temerecesunjamon.com
trynica.com
nubehost365.com
phulieumaytanbinh.com
bluprintthebrand.com
mitchellcafeteresa.com
longtorsoswimwear.com
savannahfengshui.com
0zc8l0.xyz
eby6.com
kantinuai.com
4kph.com
knottynikkibaby.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3996-137-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/3996-143-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/5024-146-0x0000000000760000-0x000000000078F000-memory.dmp formbook behavioral2/memory/5024-150-0x0000000000760000-0x000000000078F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeZiraat Bankasi Swift Mesaji.exeNETSTAT.EXEdescription pid process target process PID 1424 set thread context of 3996 1424 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 3996 set thread context of 424 3996 Ziraat Bankasi Swift Mesaji.exe Explorer.EXE PID 5024 set thread context of 424 5024 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 5024 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeNETSTAT.EXEpid process 3996 Ziraat Bankasi Swift Mesaji.exe 3996 Ziraat Bankasi Swift Mesaji.exe 3996 Ziraat Bankasi Swift Mesaji.exe 3996 Ziraat Bankasi Swift Mesaji.exe 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE 5024 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 424 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeNETSTAT.EXEpid process 3996 Ziraat Bankasi Swift Mesaji.exe 3996 Ziraat Bankasi Swift Mesaji.exe 3996 Ziraat Bankasi Swift Mesaji.exe 5024 NETSTAT.EXE 5024 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 3996 Ziraat Bankasi Swift Mesaji.exe Token: SeDebugPrivilege 5024 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1424 wrote to memory of 3996 1424 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1424 wrote to memory of 3996 1424 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1424 wrote to memory of 3996 1424 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1424 wrote to memory of 3996 1424 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1424 wrote to memory of 3996 1424 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1424 wrote to memory of 3996 1424 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 424 wrote to memory of 5024 424 Explorer.EXE NETSTAT.EXE PID 424 wrote to memory of 5024 424 Explorer.EXE NETSTAT.EXE PID 424 wrote to memory of 5024 424 Explorer.EXE NETSTAT.EXE PID 5024 wrote to memory of 4976 5024 NETSTAT.EXE cmd.exe PID 5024 wrote to memory of 4976 5024 NETSTAT.EXE cmd.exe PID 5024 wrote to memory of 4976 5024 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/424-141-0x0000000002BB0000-0x0000000002C64000-memory.dmpFilesize
720KB
-
memory/424-151-0x0000000007FE0000-0x000000000809D000-memory.dmpFilesize
756KB
-
memory/424-149-0x0000000007FE0000-0x000000000809D000-memory.dmpFilesize
756KB
-
memory/1424-131-0x0000000008320000-0x00000000088C4000-memory.dmpFilesize
5.6MB
-
memory/1424-132-0x0000000007D70000-0x0000000007E02000-memory.dmpFilesize
584KB
-
memory/1424-133-0x00000000058C0000-0x00000000058CA000-memory.dmpFilesize
40KB
-
memory/1424-134-0x000000000B650000-0x000000000B6EC000-memory.dmpFilesize
624KB
-
memory/1424-135-0x000000000BAD0000-0x000000000BB36000-memory.dmpFilesize
408KB
-
memory/1424-130-0x0000000000E20000-0x0000000000ED2000-memory.dmpFilesize
712KB
-
memory/3996-140-0x00000000017E0000-0x00000000017F5000-memory.dmpFilesize
84KB
-
memory/3996-139-0x0000000001440000-0x000000000178A000-memory.dmpFilesize
3.3MB
-
memory/3996-143-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3996-137-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3996-136-0x0000000000000000-mapping.dmp
-
memory/4976-144-0x0000000000000000-mapping.dmp
-
memory/5024-142-0x0000000000000000-mapping.dmp
-
memory/5024-145-0x0000000000230000-0x000000000023B000-memory.dmpFilesize
44KB
-
memory/5024-146-0x0000000000760000-0x000000000078F000-memory.dmpFilesize
188KB
-
memory/5024-147-0x00000000010E0000-0x000000000142A000-memory.dmpFilesize
3.3MB
-
memory/5024-148-0x0000000001020000-0x00000000010B4000-memory.dmpFilesize
592KB
-
memory/5024-150-0x0000000000760000-0x000000000078F000-memory.dmpFilesize
188KB