Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 11:21
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat bankası swift mesaji.exe
Resource
win7-20220414-en
General
-
Target
Ziraat bankası swift mesaji.exe
-
Size
522KB
-
MD5
c701756136a34c15f281ce2fe6fd5904
-
SHA1
3002137e113c3b4b26f9aae7cd09b72a21146cb8
-
SHA256
c400e648af78ed3677bdca0096b54ea9e39c7418af48f4cac2936f424eb0ddc5
-
SHA512
4bccea01bf84da7829b64f02222149ea3b9093c23b8e699e20a17db6694e2e22b5a2820a1ebb356452844aa71c2f421c707e14e171662681e83b04204a7c81d4
Malware Config
Extracted
formbook
4.1
mh76
healthgovcalottery.net
wenxinliao.com
rooterphd.com
bbobbo.one
american-mes-de-dezembro.xyz
mintager.com
thespecialtstore.com
wemakegreenhomes.com
occurandmental.xyz
fidelityrealtytitle.com
numerisat.asia
wearestallions.com
supxl.com
rajacumi.com
renaziv.online
blixtindustries.com
fjljq.com
exploretrivenicamping.com
authenticusspa.com
uucloud.press
conclaveraleighapts.com
moqaq.com
graphicressie.com
homebest.online
yisaco.com
thedrybonesareawakening.com
browardhomeappraisal.com
xn--agroisleos-09a.com
clinchrecovery.com
rekoladev.com
mlbl1.xyz
tunecaring.com
avconstant.com
chelseavictorioustravels.com
esrfy.xyz
frijolitoswey.com
zsfsidltd.com
natashasadler.com
kice1.xyz
drivemytrains.xyz
shopalthosa.xyz
merendri.com
yetkiliveznem7.xyz
milestonesconstruction.com
apparodeoexpos.com
momotou.xyz
chatkhoneh.com
cacconsults.com
kigif-indonesia.com
segurambiental.com
verynicegirls.com
curearrow.com
fdupcoffee.com
theclevergolfers.com
moushimonster.com
qdchuangyedaikuan.com
hopefortodayrecovery.com
wk6agoboyxg6.xyz
giybetfm.com
completedn.xyz
eluawastudio.com
legacysportsusatexas.com
comgmaik.com
intelsearchtech.com
northpierangling.info
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/992-60-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/992-61-0x000000000041F1A0-mapping.dmp formbook behavioral1/memory/992-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/740-71-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/740-75-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ziraat bankası swift mesaji.exeInstallUtil.exeraserver.exedescription pid process target process PID 1452 set thread context of 992 1452 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 992 set thread context of 1188 992 InstallUtil.exe Explorer.EXE PID 740 set thread context of 1188 740 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
Ziraat bankası swift mesaji.exeInstallUtil.exeraserver.exepid process 1452 Ziraat bankası swift mesaji.exe 992 InstallUtil.exe 992 InstallUtil.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe 740 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.exeraserver.exepid process 992 InstallUtil.exe 992 InstallUtil.exe 992 InstallUtil.exe 740 raserver.exe 740 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
InstallUtil.exeraserver.exedescription pid process Token: SeDebugPrivilege 992 InstallUtil.exe Token: SeDebugPrivilege 740 raserver.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Ziraat bankası swift mesaji.exeExplorer.EXEraserver.exedescription pid process target process PID 1452 wrote to memory of 992 1452 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1452 wrote to memory of 992 1452 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1452 wrote to memory of 992 1452 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1452 wrote to memory of 992 1452 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1452 wrote to memory of 992 1452 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1452 wrote to memory of 992 1452 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1452 wrote to memory of 992 1452 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1452 wrote to memory of 992 1452 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1452 wrote to memory of 992 1452 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1452 wrote to memory of 992 1452 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1188 wrote to memory of 740 1188 Explorer.EXE raserver.exe PID 1188 wrote to memory of 740 1188 Explorer.EXE raserver.exe PID 1188 wrote to memory of 740 1188 Explorer.EXE raserver.exe PID 1188 wrote to memory of 740 1188 Explorer.EXE raserver.exe PID 740 wrote to memory of 316 740 raserver.exe cmd.exe PID 740 wrote to memory of 316 740 raserver.exe cmd.exe PID 740 wrote to memory of 316 740 raserver.exe cmd.exe PID 740 wrote to memory of 316 740 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\Ziraat bankası swift mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat bankası swift mesaji.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:992 -
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵PID:316
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-69-0x0000000000000000-mapping.dmp
-
memory/740-67-0x0000000000000000-mapping.dmp
-
memory/740-75-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/740-73-0x0000000001D90000-0x0000000001E24000-memory.dmpFilesize
592KB
-
memory/740-72-0x0000000001EB0000-0x00000000021B3000-memory.dmpFilesize
3.0MB
-
memory/740-71-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/740-70-0x0000000000630000-0x000000000064C000-memory.dmpFilesize
112KB
-
memory/740-68-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/992-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/992-65-0x0000000000150000-0x0000000000165000-memory.dmpFilesize
84KB
-
memory/992-64-0x0000000000D30000-0x0000000001033000-memory.dmpFilesize
3.0MB
-
memory/992-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/992-61-0x000000000041F1A0-mapping.dmp
-
memory/992-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/992-57-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1188-66-0x0000000007640000-0x00000000077C8000-memory.dmpFilesize
1.5MB
-
memory/1188-74-0x0000000008360000-0x00000000084E9000-memory.dmpFilesize
1.5MB
-
memory/1188-76-0x0000000008360000-0x00000000084E9000-memory.dmpFilesize
1.5MB
-
memory/1452-54-0x0000000000E50000-0x0000000000ED8000-memory.dmpFilesize
544KB
-
memory/1452-56-0x0000000000AC0000-0x0000000000B0C000-memory.dmpFilesize
304KB
-
memory/1452-55-0x0000000004B60000-0x0000000004C06000-memory.dmpFilesize
664KB