Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 15:58
General
-
Target
Ziraat Bankasi Swift Mesaji.exe
-
Size
515KB
-
MD5
10fa9d1cf17c0182373f342fbed0bd8d
-
SHA1
0f248be8143358714b8775174fd91309ce21c96d
-
SHA256
1309ca7e7b81db3bea317c139fddf9124c47c3fc4b4113b44fe56af16dc39a88
-
SHA512
4f0339f58b7fdeae72359c22fc4a8105791ce5dc5c5ded36ad0a04893fe46480d2e8b42ef27efb352c9f473626c79fc5c587e82376209b970d295914444f14e2
Malware Config
Extracted
formbook
4.1
kn30
edeniabenz.com
laurenjsettles.com
schwyzerland.com
hdrslh.com
talleresmasabrazos.com
wesdop.xyz
xn--abcj-doab.net
visioresearch.net
vostextes.com
santoriniconciergethira.com
seektrainings.com
dogsocats.com
munjanichemical.com
sapnemekyadekha.online
hiartwork.com
remarquehomebuilders.com
huilege.com
pjslot.net
greatsolutionwebsite.xyz
graciousclothingstore.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook Payload 4 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1060-137-0x0000000002A10000-0x0000000002AE8000-memory.dmpFilesize
864KB
-
memory/1060-147-0x0000000007250000-0x00000000072F7000-memory.dmpFilesize
668KB
-
memory/1060-145-0x0000000007250000-0x00000000072F7000-memory.dmpFilesize
668KB
-
memory/2704-131-0x0000000005820000-0x00000000058B2000-memory.dmpFilesize
584KB
-
memory/2704-130-0x0000000000C30000-0x0000000000CB6000-memory.dmpFilesize
536KB
-
memory/3764-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3764-136-0x0000000001910000-0x0000000001925000-memory.dmpFilesize
84KB
-
memory/3764-135-0x0000000001940000-0x0000000001C8A000-memory.dmpFilesize
3.3MB
-
memory/3764-133-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3764-132-0x0000000000000000-mapping.dmp
-
memory/4064-140-0x0000000000000000-mapping.dmp
-
memory/4916-138-0x0000000000000000-mapping.dmp
-
memory/4916-141-0x0000000000030000-0x0000000000036000-memory.dmpFilesize
24KB
-
memory/4916-143-0x0000000000EA0000-0x0000000000ECF000-memory.dmpFilesize
188KB
-
memory/4916-142-0x0000000002E70000-0x00000000031BA000-memory.dmpFilesize
3.3MB
-
memory/4916-144-0x0000000002C50000-0x0000000002CE4000-memory.dmpFilesize
592KB
-
memory/4916-146-0x0000000000EA0000-0x0000000000ECF000-memory.dmpFilesize
188KB