Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-07-2022 11:21
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat bankası swift mesaji.exe
Resource
win7-20220414-en
General
-
Target
Ziraat bankası swift mesaji.exe
-
Size
522KB
-
MD5
c701756136a34c15f281ce2fe6fd5904
-
SHA1
3002137e113c3b4b26f9aae7cd09b72a21146cb8
-
SHA256
c400e648af78ed3677bdca0096b54ea9e39c7418af48f4cac2936f424eb0ddc5
-
SHA512
4bccea01bf84da7829b64f02222149ea3b9093c23b8e699e20a17db6694e2e22b5a2820a1ebb356452844aa71c2f421c707e14e171662681e83b04204a7c81d4
Malware Config
Extracted
formbook
4.1
mh76
healthgovcalottery.net
wenxinliao.com
rooterphd.com
bbobbo.one
american-mes-de-dezembro.xyz
mintager.com
thespecialtstore.com
wemakegreenhomes.com
occurandmental.xyz
fidelityrealtytitle.com
numerisat.asia
wearestallions.com
supxl.com
rajacumi.com
renaziv.online
blixtindustries.com
fjljq.com
exploretrivenicamping.com
authenticusspa.com
uucloud.press
conclaveraleighapts.com
moqaq.com
graphicressie.com
homebest.online
yisaco.com
thedrybonesareawakening.com
browardhomeappraisal.com
xn--agroisleos-09a.com
clinchrecovery.com
rekoladev.com
mlbl1.xyz
tunecaring.com
avconstant.com
chelseavictorioustravels.com
esrfy.xyz
frijolitoswey.com
zsfsidltd.com
natashasadler.com
kice1.xyz
drivemytrains.xyz
shopalthosa.xyz
merendri.com
yetkiliveznem7.xyz
milestonesconstruction.com
apparodeoexpos.com
momotou.xyz
chatkhoneh.com
cacconsults.com
kigif-indonesia.com
segurambiental.com
verynicegirls.com
curearrow.com
fdupcoffee.com
theclevergolfers.com
moushimonster.com
qdchuangyedaikuan.com
hopefortodayrecovery.com
wk6agoboyxg6.xyz
giybetfm.com
completedn.xyz
eluawastudio.com
legacysportsusatexas.com
comgmaik.com
intelsearchtech.com
northpierangling.info
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/60-133-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/60-135-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/1756-141-0x0000000000440000-0x000000000046F000-memory.dmp formbook behavioral2/memory/1756-144-0x0000000000440000-0x000000000046F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ziraat bankası swift mesaji.exeInstallUtil.execolorcpl.exedescription pid process target process PID 5092 set thread context of 60 5092 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 60 set thread context of 2560 60 InstallUtil.exe Explorer.EXE PID 1756 set thread context of 2560 1756 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Ziraat bankası swift mesaji.exeInstallUtil.execolorcpl.exepid process 5092 Ziraat bankası swift mesaji.exe 5092 Ziraat bankası swift mesaji.exe 60 InstallUtil.exe 60 InstallUtil.exe 60 InstallUtil.exe 60 InstallUtil.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe 1756 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2560 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.execolorcpl.exepid process 60 InstallUtil.exe 60 InstallUtil.exe 60 InstallUtil.exe 1756 colorcpl.exe 1756 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
InstallUtil.execolorcpl.exedescription pid process Token: SeDebugPrivilege 60 InstallUtil.exe Token: SeDebugPrivilege 1756 colorcpl.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Ziraat bankası swift mesaji.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 5092 wrote to memory of 60 5092 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 5092 wrote to memory of 60 5092 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 5092 wrote to memory of 60 5092 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 5092 wrote to memory of 60 5092 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 5092 wrote to memory of 60 5092 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 5092 wrote to memory of 60 5092 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 2560 wrote to memory of 1756 2560 Explorer.EXE colorcpl.exe PID 2560 wrote to memory of 1756 2560 Explorer.EXE colorcpl.exe PID 2560 wrote to memory of 1756 2560 Explorer.EXE colorcpl.exe PID 1756 wrote to memory of 3228 1756 colorcpl.exe cmd.exe PID 1756 wrote to memory of 3228 1756 colorcpl.exe cmd.exe PID 1756 wrote to memory of 3228 1756 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat bankası swift mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat bankası swift mesaji.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/60-136-0x00000000014B0000-0x00000000017FA000-memory.dmpFilesize
3.3MB
-
memory/60-137-0x0000000001480000-0x0000000001495000-memory.dmpFilesize
84KB
-
memory/60-132-0x0000000000000000-mapping.dmp
-
memory/60-133-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/60-135-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1756-139-0x0000000000000000-mapping.dmp
-
memory/1756-140-0x00000000005D0000-0x00000000005E9000-memory.dmpFilesize
100KB
-
memory/1756-141-0x0000000000440000-0x000000000046F000-memory.dmpFilesize
188KB
-
memory/1756-143-0x0000000002500000-0x000000000284A000-memory.dmpFilesize
3.3MB
-
memory/1756-144-0x0000000000440000-0x000000000046F000-memory.dmpFilesize
188KB
-
memory/1756-145-0x0000000002240000-0x00000000022D4000-memory.dmpFilesize
592KB
-
memory/2560-138-0x0000000002DA0000-0x0000000002EDB000-memory.dmpFilesize
1.2MB
-
memory/2560-146-0x0000000007C40000-0x0000000007D42000-memory.dmpFilesize
1.0MB
-
memory/2560-147-0x0000000007C40000-0x0000000007D42000-memory.dmpFilesize
1.0MB
-
memory/3228-142-0x0000000000000000-mapping.dmp
-
memory/5092-131-0x0000000005320000-0x00000000053B2000-memory.dmpFilesize
584KB
-
memory/5092-130-0x00000000006B0000-0x0000000000738000-memory.dmpFilesize
544KB