Analysis
-
max time kernel
163s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 09:15
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat Bankasi Swift Mesaji.exe
Resource
win7-20220718-en
General
-
Target
Ziraat Bankasi Swift Mesaji.exe
-
Size
605KB
-
MD5
3951678c7d514392e736a3f42a3bf422
-
SHA1
69a7646f8abc926da7f476e87b0d47f07b15344f
-
SHA256
7cb158ee1638efc7f9d163b16a0ef549eb28c741d5cdd0c348a23e246fd5fbdf
-
SHA512
b8c102bbd6f6ed3233f59af809087c086a1604d2c97ae7978d431b2d52dfb1f13230a2b9ec76051c32be1db40eb960ba5be997df1953baba9d5b4caae2c69e44
Malware Config
Extracted
formbook
4.1
bt62
mmajesty.xyz
wildgoodnessgardens.com
luicodraft.xyz
tontobox.store
kericarr.com
taramayoros.com
sluesn.online
tamdavinhlong.com
powdermountain.tours
spydecelular.site
supportjamesbrown.com
lemonzest.store
kofekloud.com
you-got-a-sec.com
sunu-ocr.com
xn--nxw840bmnh.xn--czru2d
thepeninsulachicago.com
cers.online
ozmintmanagement.com
shopninib.com
cryptobeancounters.xyz
drhaviland.com
digital-referral.net
globalpmleague.com
surokkhagov.com
cheap-website.net
m20giraffe.com
classic-pizza.store
custrecs.info
tenderyearstutoring.com
standtasarimi.online
x3wa.com
hzzsfj.com
wooddingo.com
filasko-tilbud.com
bigdicksinsurance.com
vw24ty15.com
lyushh.com
dewebmx.com
magbo24.biz
illmobile.com
usnwaq.online
abishanamus.com
hsbc2323.com
certifica-flowe.com
aion-misteria.online
streaken.xyz
armicacciaetiro.info
sjohnsonins.com
inda-pendant.com
superherocleaning.com
code2god.com
italianfinefinishes.com
everantdigital.com
kimpruxa.com
evreix.com
avobub.com
drain-pipe-cleaning-58895.com
kdc-codestates.com
health3.club
renova1.com
networthwhile.com
peahos.online
evyienen.com
mysurely.life
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1228-63-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1228-64-0x000000000041F0E0-mapping.dmp formbook behavioral1/memory/1228-66-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1116-73-0x0000000000070000-0x000000000009F000-memory.dmp formbook behavioral1/memory/1116-77-0x0000000000070000-0x000000000009F000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 300 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeZiraat Bankasi Swift Mesaji.execscript.exedescription pid process target process PID 1900 set thread context of 1228 1900 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1228 set thread context of 1272 1228 Ziraat Bankasi Swift Mesaji.exe Explorer.EXE PID 1116 set thread context of 1272 1116 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.execscript.exepid process 1228 Ziraat Bankasi Swift Mesaji.exe 1228 Ziraat Bankasi Swift Mesaji.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe 1116 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.execscript.exepid process 1228 Ziraat Bankasi Swift Mesaji.exe 1228 Ziraat Bankasi Swift Mesaji.exe 1228 Ziraat Bankasi Swift Mesaji.exe 1116 cscript.exe 1116 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.execscript.exedescription pid process Token: SeDebugPrivilege 1228 Ziraat Bankasi Swift Mesaji.exe Token: SeDebugPrivilege 1116 cscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeExplorer.EXEcscript.exedescription pid process target process PID 1900 wrote to memory of 1228 1900 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1900 wrote to memory of 1228 1900 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1900 wrote to memory of 1228 1900 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1900 wrote to memory of 1228 1900 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1900 wrote to memory of 1228 1900 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1900 wrote to memory of 1228 1900 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1900 wrote to memory of 1228 1900 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1272 wrote to memory of 1116 1272 Explorer.EXE cscript.exe PID 1272 wrote to memory of 1116 1272 Explorer.EXE cscript.exe PID 1272 wrote to memory of 1116 1272 Explorer.EXE cscript.exe PID 1272 wrote to memory of 1116 1272 Explorer.EXE cscript.exe PID 1116 wrote to memory of 300 1116 cscript.exe cmd.exe PID 1116 wrote to memory of 300 1116 cscript.exe cmd.exe PID 1116 wrote to memory of 300 1116 cscript.exe cmd.exe PID 1116 wrote to memory of 300 1116 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/300-71-0x0000000000000000-mapping.dmp
-
memory/1116-70-0x0000000000000000-mapping.dmp
-
memory/1116-77-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/1116-75-0x0000000000710000-0x00000000007A3000-memory.dmpFilesize
588KB
-
memory/1116-74-0x00000000020A0000-0x00000000023A3000-memory.dmpFilesize
3.0MB
-
memory/1116-73-0x0000000000070000-0x000000000009F000-memory.dmpFilesize
188KB
-
memory/1116-72-0x00000000004B0000-0x00000000004D2000-memory.dmpFilesize
136KB
-
memory/1228-68-0x00000000006A0000-0x00000000006B4000-memory.dmpFilesize
80KB
-
memory/1228-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1228-64-0x000000000041F0E0-mapping.dmp
-
memory/1228-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1228-67-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/1228-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1228-63-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1272-69-0x00000000068E0000-0x0000000006A4F000-memory.dmpFilesize
1.4MB
-
memory/1272-76-0x0000000004E60000-0x0000000004F3C000-memory.dmpFilesize
880KB
-
memory/1272-78-0x0000000004E60000-0x0000000004F3C000-memory.dmpFilesize
880KB
-
memory/1900-54-0x00000000000D0000-0x000000000016E000-memory.dmpFilesize
632KB
-
memory/1900-59-0x0000000001F50000-0x0000000001F84000-memory.dmpFilesize
208KB
-
memory/1900-58-0x0000000005A00000-0x0000000005A82000-memory.dmpFilesize
520KB
-
memory/1900-57-0x0000000000420000-0x000000000042A000-memory.dmpFilesize
40KB
-
memory/1900-56-0x00000000003A0000-0x00000000003B6000-memory.dmpFilesize
88KB
-
memory/1900-55-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB