Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 13:03
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat bankası swift mesaji.exe
Resource
win7-20220414-en
General
-
Target
Ziraat bankası swift mesaji.exe
-
Size
522KB
-
MD5
c701756136a34c15f281ce2fe6fd5904
-
SHA1
3002137e113c3b4b26f9aae7cd09b72a21146cb8
-
SHA256
c400e648af78ed3677bdca0096b54ea9e39c7418af48f4cac2936f424eb0ddc5
-
SHA512
4bccea01bf84da7829b64f02222149ea3b9093c23b8e699e20a17db6694e2e22b5a2820a1ebb356452844aa71c2f421c707e14e171662681e83b04204a7c81d4
Malware Config
Extracted
formbook
4.1
mh76
healthgovcalottery.net
wenxinliao.com
rooterphd.com
bbobbo.one
american-mes-de-dezembro.xyz
mintager.com
thespecialtstore.com
wemakegreenhomes.com
occurandmental.xyz
fidelityrealtytitle.com
numerisat.asia
wearestallions.com
supxl.com
rajacumi.com
renaziv.online
blixtindustries.com
fjljq.com
exploretrivenicamping.com
authenticusspa.com
uucloud.press
conclaveraleighapts.com
moqaq.com
graphicressie.com
homebest.online
yisaco.com
thedrybonesareawakening.com
browardhomeappraisal.com
xn--agroisleos-09a.com
clinchrecovery.com
rekoladev.com
mlbl1.xyz
tunecaring.com
avconstant.com
chelseavictorioustravels.com
esrfy.xyz
frijolitoswey.com
zsfsidltd.com
natashasadler.com
kice1.xyz
drivemytrains.xyz
shopalthosa.xyz
merendri.com
yetkiliveznem7.xyz
milestonesconstruction.com
apparodeoexpos.com
momotou.xyz
chatkhoneh.com
cacconsults.com
kigif-indonesia.com
segurambiental.com
verynicegirls.com
curearrow.com
fdupcoffee.com
theclevergolfers.com
moushimonster.com
qdchuangyedaikuan.com
hopefortodayrecovery.com
wk6agoboyxg6.xyz
giybetfm.com
completedn.xyz
eluawastudio.com
legacysportsusatexas.com
comgmaik.com
intelsearchtech.com
northpierangling.info
Signatures
-
Formbook Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1304-60-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1304-61-0x000000000041F1A0-mapping.dmp formbook behavioral1/memory/1304-67-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1240-70-0x0000000000080000-0x00000000000AF000-memory.dmp formbook behavioral1/memory/1240-74-0x0000000000080000-0x00000000000AF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ziraat bankası swift mesaji.exeInstallUtil.exeNAPSTAT.EXEdescription pid process target process PID 1080 set thread context of 1304 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1304 set thread context of 1292 1304 InstallUtil.exe Explorer.EXE PID 1240 set thread context of 1292 1240 NAPSTAT.EXE Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Ziraat bankası swift mesaji.exeInstallUtil.exeNAPSTAT.EXEpid process 1080 Ziraat bankası swift mesaji.exe 1080 Ziraat bankası swift mesaji.exe 1080 Ziraat bankası swift mesaji.exe 1304 InstallUtil.exe 1304 InstallUtil.exe 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.exeNAPSTAT.EXEpid process 1304 InstallUtil.exe 1304 InstallUtil.exe 1304 InstallUtil.exe 1240 NAPSTAT.EXE 1240 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Ziraat bankası swift mesaji.exeInstallUtil.exeNAPSTAT.EXEdescription pid process Token: SeDebugPrivilege 1080 Ziraat bankası swift mesaji.exe Token: SeDebugPrivilege 1304 InstallUtil.exe Token: SeDebugPrivilege 1240 NAPSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1292 Explorer.EXE 1292 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1292 Explorer.EXE 1292 Explorer.EXE -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
Ziraat bankası swift mesaji.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 1080 wrote to memory of 272 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 272 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 272 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 272 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 272 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 272 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 272 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 1304 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 1304 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 1304 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 1304 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 1304 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 1304 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 1304 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 1304 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 1304 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1080 wrote to memory of 1304 1080 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 1292 wrote to memory of 1240 1292 Explorer.EXE NAPSTAT.EXE PID 1292 wrote to memory of 1240 1292 Explorer.EXE NAPSTAT.EXE PID 1292 wrote to memory of 1240 1292 Explorer.EXE NAPSTAT.EXE PID 1292 wrote to memory of 1240 1292 Explorer.EXE NAPSTAT.EXE PID 1240 wrote to memory of 1524 1240 NAPSTAT.EXE cmd.exe PID 1240 wrote to memory of 1524 1240 NAPSTAT.EXE cmd.exe PID 1240 wrote to memory of 1524 1240 NAPSTAT.EXE cmd.exe PID 1240 wrote to memory of 1524 1240 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat bankası swift mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat bankası swift mesaji.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1080-54-0x0000000000BE0000-0x0000000000C68000-memory.dmpFilesize
544KB
-
memory/1080-55-0x0000000004B80000-0x0000000004C26000-memory.dmpFilesize
664KB
-
memory/1080-56-0x0000000000AB0000-0x0000000000AFC000-memory.dmpFilesize
304KB
-
memory/1240-71-0x00000000020B0000-0x00000000023B3000-memory.dmpFilesize
3.0MB
-
memory/1240-69-0x00000000002F0000-0x0000000000336000-memory.dmpFilesize
280KB
-
memory/1240-74-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1240-72-0x0000000001DE0000-0x0000000001E74000-memory.dmpFilesize
592KB
-
memory/1240-66-0x0000000000000000-mapping.dmp
-
memory/1240-70-0x0000000000080000-0x00000000000AF000-memory.dmpFilesize
188KB
-
memory/1292-75-0x0000000006A10000-0x0000000006B3F000-memory.dmpFilesize
1.2MB
-
memory/1292-73-0x0000000006A10000-0x0000000006B3F000-memory.dmpFilesize
1.2MB
-
memory/1292-65-0x00000000043C0000-0x00000000044AC000-memory.dmpFilesize
944KB
-
memory/1304-64-0x00000000001A0000-0x00000000001B5000-memory.dmpFilesize
84KB
-
memory/1304-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1304-57-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1304-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1304-63-0x00000000008E0000-0x0000000000BE3000-memory.dmpFilesize
3.0MB
-
memory/1304-61-0x000000000041F1A0-mapping.dmp
-
memory/1304-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1524-68-0x0000000000000000-mapping.dmp