Analysis
-
max time kernel
148s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 09:15
Static task
static1
Behavioral task
behavioral1
Sample
Ziraat Bankasi Swift Mesaji.exe
Resource
win7-20220718-en
General
-
Target
Ziraat Bankasi Swift Mesaji.exe
-
Size
605KB
-
MD5
3951678c7d514392e736a3f42a3bf422
-
SHA1
69a7646f8abc926da7f476e87b0d47f07b15344f
-
SHA256
7cb158ee1638efc7f9d163b16a0ef549eb28c741d5cdd0c348a23e246fd5fbdf
-
SHA512
b8c102bbd6f6ed3233f59af809087c086a1604d2c97ae7978d431b2d52dfb1f13230a2b9ec76051c32be1db40eb960ba5be997df1953baba9d5b4caae2c69e44
Malware Config
Extracted
formbook
4.1
bt62
mmajesty.xyz
wildgoodnessgardens.com
luicodraft.xyz
tontobox.store
kericarr.com
taramayoros.com
sluesn.online
tamdavinhlong.com
powdermountain.tours
spydecelular.site
supportjamesbrown.com
lemonzest.store
kofekloud.com
you-got-a-sec.com
sunu-ocr.com
xn--nxw840bmnh.xn--czru2d
thepeninsulachicago.com
cers.online
ozmintmanagement.com
shopninib.com
cryptobeancounters.xyz
drhaviland.com
digital-referral.net
globalpmleague.com
surokkhagov.com
cheap-website.net
m20giraffe.com
classic-pizza.store
custrecs.info
tenderyearstutoring.com
standtasarimi.online
x3wa.com
hzzsfj.com
wooddingo.com
filasko-tilbud.com
bigdicksinsurance.com
vw24ty15.com
lyushh.com
dewebmx.com
magbo24.biz
illmobile.com
usnwaq.online
abishanamus.com
hsbc2323.com
certifica-flowe.com
aion-misteria.online
streaken.xyz
armicacciaetiro.info
sjohnsonins.com
inda-pendant.com
superherocleaning.com
code2god.com
italianfinefinishes.com
everantdigital.com
kimpruxa.com
evreix.com
avobub.com
drain-pipe-cleaning-58895.com
kdc-codestates.com
health3.club
renova1.com
networthwhile.com
peahos.online
evyienen.com
mysurely.life
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4300-137-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4300-139-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral2/memory/4076-145-0x0000000001220000-0x000000000124F000-memory.dmp formbook behavioral2/memory/4076-148-0x0000000001220000-0x000000000124F000-memory.dmp formbook -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeZiraat Bankasi Swift Mesaji.execolorcpl.exedescription pid process target process PID 4772 set thread context of 4300 4772 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 4300 set thread context of 1032 4300 Ziraat Bankasi Swift Mesaji.exe Explorer.EXE PID 4076 set thread context of 1032 4076 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.execolorcpl.exepid process 4300 Ziraat Bankasi Swift Mesaji.exe 4300 Ziraat Bankasi Swift Mesaji.exe 4300 Ziraat Bankasi Swift Mesaji.exe 4300 Ziraat Bankasi Swift Mesaji.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe 4076 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1032 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.execolorcpl.exepid process 4300 Ziraat Bankasi Swift Mesaji.exe 4300 Ziraat Bankasi Swift Mesaji.exe 4300 Ziraat Bankasi Swift Mesaji.exe 4076 colorcpl.exe 4076 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.execolorcpl.exedescription pid process Token: SeDebugPrivilege 4300 Ziraat Bankasi Swift Mesaji.exe Token: SeDebugPrivilege 4076 colorcpl.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Ziraat Bankasi Swift Mesaji.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 4772 wrote to memory of 4300 4772 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 4772 wrote to memory of 4300 4772 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 4772 wrote to memory of 4300 4772 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 4772 wrote to memory of 4300 4772 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 4772 wrote to memory of 4300 4772 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 4772 wrote to memory of 4300 4772 Ziraat Bankasi Swift Mesaji.exe Ziraat Bankasi Swift Mesaji.exe PID 1032 wrote to memory of 4076 1032 Explorer.EXE colorcpl.exe PID 1032 wrote to memory of 4076 1032 Explorer.EXE colorcpl.exe PID 1032 wrote to memory of 4076 1032 Explorer.EXE colorcpl.exe PID 4076 wrote to memory of 4836 4076 colorcpl.exe cmd.exe PID 4076 wrote to memory of 4836 4076 colorcpl.exe cmd.exe PID 4076 wrote to memory of 4836 4076 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Ziraat Bankasi Swift Mesaji.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1032-142-0x0000000008A40000-0x0000000008B4C000-memory.dmpFilesize
1.0MB
-
memory/1032-151-0x0000000003110000-0x000000000320E000-memory.dmpFilesize
1016KB
-
memory/1032-150-0x0000000003110000-0x000000000320E000-memory.dmpFilesize
1016KB
-
memory/4076-149-0x0000000003080000-0x0000000003113000-memory.dmpFilesize
588KB
-
memory/4076-148-0x0000000001220000-0x000000000124F000-memory.dmpFilesize
188KB
-
memory/4076-147-0x00000000031E0000-0x000000000352A000-memory.dmpFilesize
3.3MB
-
memory/4076-144-0x0000000000520000-0x0000000000539000-memory.dmpFilesize
100KB
-
memory/4076-145-0x0000000001220000-0x000000000124F000-memory.dmpFilesize
188KB
-
memory/4076-143-0x0000000000000000-mapping.dmp
-
memory/4300-136-0x0000000000000000-mapping.dmp
-
memory/4300-140-0x00000000016A0000-0x00000000019EA000-memory.dmpFilesize
3.3MB
-
memory/4300-141-0x0000000001B50000-0x0000000001B64000-memory.dmpFilesize
80KB
-
memory/4300-139-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4300-137-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/4772-135-0x0000000000F00000-0x0000000000F66000-memory.dmpFilesize
408KB
-
memory/4772-130-0x0000000000410000-0x00000000004AE000-memory.dmpFilesize
632KB
-
memory/4772-134-0x0000000006EA0000-0x0000000006F3C000-memory.dmpFilesize
624KB
-
memory/4772-133-0x0000000004ED0000-0x0000000004EDA000-memory.dmpFilesize
40KB
-
memory/4772-132-0x0000000004E30000-0x0000000004EC2000-memory.dmpFilesize
584KB
-
memory/4772-131-0x00000000052F0000-0x0000000005894000-memory.dmpFilesize
5.6MB
-
memory/4836-146-0x0000000000000000-mapping.dmp