Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-06-2022 12:30
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat Bankasi Swift Mesaji.exe
Resource
win7-20220414-en
General
-
Target
Ziraat Bankasi Swift Mesaji.exe
-
Size
690KB
-
MD5
ad8c1fb6847c90cec8545d5a1d12e098
-
SHA1
75587c6e26bb845a03b2c17526f85561e2664c10
-
SHA256
32b7d0b30638db08927b43bb633cb29da62ab634c34de42ff582841191c31839
-
SHA512
8b867ca4f8d538aef19b2707195aa0b6e83bb42b54ab035d00e52bdb6881e378a55580431b38ea60d5e87462656b2662bab56e42e2b22dd2a15a33f15d18152d
Malware Config
Extracted
formbook
4.1
pr28
warehouseufohighbay.com
kingasia77.xyz
americanoutfittes.com
jemodaevangica.com
holigantv82.com
creamkidslife.com
skillzplanetoutreach.com
goldencityofficial.com
choiceaccessorise.com
kdgkzy.com
patra.tech
chicaglo.com
9491countyroad106.com
theultracleanser.com
lesmacarons.biz
kfaluminum.com
institutodiversidade.com
woodanqnmz.store
teslabuyerusa.com
cityofbastop.com
firegillibrand.com
npsyu5n-periv.com
nflstreams.pro
resuelve-deuda-latam-pro.com
281564.com
ezeehookz.com
rvestdewseherore.xyz
modderplaten.com
getdapp.xyz
tutsempire.com
scientiaimaging.com
cryptoriver-island.xyz
occidentalinn.net
decouvredesproduits.com
queensize.xyz
ipandu.net
yingxinyiyuan.com
suddeniink.com
guestwin.com
curahintstudio.xyz
5g00au.com
ncfirerestoration.com
diabeticlifeinsurancequotes.com
sex-intim-kropivnickiy.online
metashae.com
flora-kana.com
productsamerica.store
buliangdh90.xyz
georgiatourz.com
coveredbyaaa.com
wirethreepebble.com
jeffreygraper.com
temerecesunjamon.com
trynica.com
nubehost365.com
phulieumaytanbinh.com
bluprintthebrand.com
mitchellcafeteresa.com
longtorsoswimwear.com
savannahfengshui.com
0zc8l0.xyz
eby6.com
kantinuai.com
4kph.com
knottynikkibaby.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1588-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1588-64-0x000000000041F1C0-mapping.dmp formbook behavioral1/memory/1588-70-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1584-74-0x0000000000070000-0x000000000009F000-memory.dmp formbook behavioral1/memory/1584-77-0x0000000000070000-0x000000000009F000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1296 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeZiraat Bankasi Swift Mesaji.exewscript.exedescription pid process target process PID 1992 set thread context of 1588 1992 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1588 set thread context of 1256 1588 Ziraat Bankasi Swift Mesaji.exe Explorer.EXE PID 1584 set thread context of 1256 1584 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exewscript.exepid process 1588 Ziraat Bankasi Swift Mesaji.exe 1588 Ziraat Bankasi Swift Mesaji.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe 1584 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exewscript.exepid process 1588 Ziraat Bankasi Swift Mesaji.exe 1588 Ziraat Bankasi Swift Mesaji.exe 1588 Ziraat Bankasi Swift Mesaji.exe 1584 wscript.exe 1584 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exewscript.exedescription pid process Token: SeDebugPrivilege 1588 Ziraat Bankasi Swift Mesaji.exe Token: SeDebugPrivilege 1584 wscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeExplorer.EXEwscript.exedescription pid process target process PID 1992 wrote to memory of 1588 1992 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1992 wrote to memory of 1588 1992 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1992 wrote to memory of 1588 1992 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1992 wrote to memory of 1588 1992 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1992 wrote to memory of 1588 1992 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1992 wrote to memory of 1588 1992 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1992 wrote to memory of 1588 1992 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1256 wrote to memory of 1584 1256 Explorer.EXE wscript.exe PID 1256 wrote to memory of 1584 1256 Explorer.EXE wscript.exe PID 1256 wrote to memory of 1584 1256 Explorer.EXE wscript.exe PID 1256 wrote to memory of 1584 1256 Explorer.EXE wscript.exe PID 1584 wrote to memory of 1296 1584 wscript.exe cmd.exe PID 1584 wrote to memory of 1296 1584 wscript.exe cmd.exe PID 1584 wrote to memory of 1296 1584 wscript.exe cmd.exe PID 1584 wrote to memory of 1296 1584 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1256-68-0x0000000004A90000-0x0000000004B99000-memory.dmpFilesize
1.0MB
-
memory/1256-78-0x0000000004BA0000-0x0000000004CE0000-memory.dmpFilesize
1.2MB
-
memory/1256-76-0x0000000004BA0000-0x0000000004CE0000-memory.dmpFilesize
1.2MB
-
memory/1296-71-0x0000000000000000-mapping.dmp
-
memory/1584-77-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/1584-75-0x0000000000510000-0x00000000005A4000-memory.dmpFilesize
592KB
-
memory/1584-74-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/1584-73-0x0000000002110000-0x0000000002413000-memory.dmpFilesize
3.0MB
-
memory/1584-72-0x0000000000CE0000-0x0000000000D06000-memory.dmpFilesize
152KB
-
memory/1584-69-0x0000000000000000-mapping.dmp
-
memory/1588-66-0x0000000000820000-0x0000000000B23000-memory.dmpFilesize
3.0MB
-
memory/1588-67-0x0000000000180000-0x0000000000195000-memory.dmpFilesize
84KB
-
memory/1588-64-0x000000000041F1C0-mapping.dmp
-
memory/1588-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1588-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1588-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1588-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1992-54-0x0000000000D20000-0x0000000000DD2000-memory.dmpFilesize
712KB
-
memory/1992-59-0x00000000042B0000-0x00000000042E4000-memory.dmpFilesize
208KB
-
memory/1992-58-0x0000000000C60000-0x0000000000C66000-memory.dmpFilesize
24KB
-
memory/1992-57-0x0000000008210000-0x00000000082A2000-memory.dmpFilesize
584KB
-
memory/1992-56-0x0000000000710000-0x0000000000722000-memory.dmpFilesize
72KB
-
memory/1992-55-0x00000000751C1000-0x00000000751C3000-memory.dmpFilesize
8KB