Analysis
-
max time kernel
148s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-07-2022 13:03
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat bankası swift mesaji.exe
Resource
win7-20220414-en
General
-
Target
Ziraat bankası swift mesaji.exe
-
Size
522KB
-
MD5
c701756136a34c15f281ce2fe6fd5904
-
SHA1
3002137e113c3b4b26f9aae7cd09b72a21146cb8
-
SHA256
c400e648af78ed3677bdca0096b54ea9e39c7418af48f4cac2936f424eb0ddc5
-
SHA512
4bccea01bf84da7829b64f02222149ea3b9093c23b8e699e20a17db6694e2e22b5a2820a1ebb356452844aa71c2f421c707e14e171662681e83b04204a7c81d4
Malware Config
Extracted
formbook
4.1
mh76
healthgovcalottery.net
wenxinliao.com
rooterphd.com
bbobbo.one
american-mes-de-dezembro.xyz
mintager.com
thespecialtstore.com
wemakegreenhomes.com
occurandmental.xyz
fidelityrealtytitle.com
numerisat.asia
wearestallions.com
supxl.com
rajacumi.com
renaziv.online
blixtindustries.com
fjljq.com
exploretrivenicamping.com
authenticusspa.com
uucloud.press
conclaveraleighapts.com
moqaq.com
graphicressie.com
homebest.online
yisaco.com
thedrybonesareawakening.com
browardhomeappraisal.com
xn--agroisleos-09a.com
clinchrecovery.com
rekoladev.com
mlbl1.xyz
tunecaring.com
avconstant.com
chelseavictorioustravels.com
esrfy.xyz
frijolitoswey.com
zsfsidltd.com
natashasadler.com
kice1.xyz
drivemytrains.xyz
shopalthosa.xyz
merendri.com
yetkiliveznem7.xyz
milestonesconstruction.com
apparodeoexpos.com
momotou.xyz
chatkhoneh.com
cacconsults.com
kigif-indonesia.com
segurambiental.com
verynicegirls.com
curearrow.com
fdupcoffee.com
theclevergolfers.com
moushimonster.com
qdchuangyedaikuan.com
hopefortodayrecovery.com
wk6agoboyxg6.xyz
giybetfm.com
completedn.xyz
eluawastudio.com
legacysportsusatexas.com
comgmaik.com
intelsearchtech.com
northpierangling.info
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4568-133-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4568-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/2360-142-0x0000000000FD0000-0x0000000000FFF000-memory.dmp formbook behavioral2/memory/2360-146-0x0000000000FD0000-0x0000000000FFF000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ziraat bankası swift mesaji.exeInstallUtil.execolorcpl.exedescription pid process target process PID 4844 set thread context of 4568 4844 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 4568 set thread context of 3116 4568 InstallUtil.exe Explorer.EXE PID 2360 set thread context of 3116 2360 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Ziraat bankası swift mesaji.exeInstallUtil.execolorcpl.exepid process 4844 Ziraat bankası swift mesaji.exe 4844 Ziraat bankası swift mesaji.exe 4568 InstallUtil.exe 4568 InstallUtil.exe 4568 InstallUtil.exe 4568 InstallUtil.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe 2360 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3116 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.execolorcpl.exepid process 4568 InstallUtil.exe 4568 InstallUtil.exe 4568 InstallUtil.exe 2360 colorcpl.exe 2360 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
InstallUtil.execolorcpl.exedescription pid process Token: SeDebugPrivilege 4568 InstallUtil.exe Token: SeDebugPrivilege 2360 colorcpl.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Ziraat bankası swift mesaji.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 4844 wrote to memory of 4568 4844 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 4844 wrote to memory of 4568 4844 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 4844 wrote to memory of 4568 4844 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 4844 wrote to memory of 4568 4844 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 4844 wrote to memory of 4568 4844 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 4844 wrote to memory of 4568 4844 Ziraat bankası swift mesaji.exe InstallUtil.exe PID 3116 wrote to memory of 2360 3116 Explorer.EXE colorcpl.exe PID 3116 wrote to memory of 2360 3116 Explorer.EXE colorcpl.exe PID 3116 wrote to memory of 2360 3116 Explorer.EXE colorcpl.exe PID 2360 wrote to memory of 4292 2360 colorcpl.exe cmd.exe PID 2360 wrote to memory of 4292 2360 colorcpl.exe cmd.exe PID 2360 wrote to memory of 4292 2360 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat bankası swift mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat bankası swift mesaji.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2360-142-0x0000000000FD0000-0x0000000000FFF000-memory.dmpFilesize
188KB
-
memory/2360-146-0x0000000000FD0000-0x0000000000FFF000-memory.dmpFilesize
188KB
-
memory/2360-144-0x0000000002F80000-0x0000000003014000-memory.dmpFilesize
592KB
-
memory/2360-143-0x0000000003210000-0x000000000355A000-memory.dmpFilesize
3.3MB
-
memory/2360-138-0x0000000000000000-mapping.dmp
-
memory/2360-141-0x0000000000DE0000-0x0000000000DF9000-memory.dmpFilesize
100KB
-
memory/3116-147-0x0000000008210000-0x0000000008346000-memory.dmpFilesize
1.2MB
-
memory/3116-145-0x0000000008210000-0x0000000008346000-memory.dmpFilesize
1.2MB
-
memory/3116-137-0x00000000028C0000-0x0000000002A3E000-memory.dmpFilesize
1.5MB
-
memory/4292-140-0x0000000000000000-mapping.dmp
-
memory/4568-135-0x0000000001210000-0x000000000155A000-memory.dmpFilesize
3.3MB
-
memory/4568-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4568-136-0x0000000000C60000-0x0000000000C75000-memory.dmpFilesize
84KB
-
memory/4568-133-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4568-132-0x0000000000000000-mapping.dmp
-
memory/4844-130-0x0000000000740000-0x00000000007C8000-memory.dmpFilesize
544KB
-
memory/4844-131-0x00000000053C0000-0x0000000005452000-memory.dmpFilesize
584KB